Re: [saag] NIST requests comments on using ISO/IEC 19790:2012 as the U.S. Federal Standard for cryptographic modules

I think it would be stronger if these comments went to NIST from the IETF Security Area Directors or the IESG.

Russ

On Aug 17, 2015, at 4:33 PM, Richard Barnes wrote:

> On Mon, Aug 17, 2015 at 2:48 PM, Russ Housley <housley@vigilsec.com> wrote:
>> It is not clear to me that the use of ISO/IEC 19790 offers any improvement
>> for the people that make crypto modules or the people that purchase crypto
>> modules.  The specification being behind a paywall means that fewer people
>> will know what it says.  Since the existing FIPS documents are freely
>> available online, this seems to me to be a move in the wrong direction.
> 
> +1, but presumably these comments should be going to some NIST channel?
> 
>> 
>> Russ
>> 
>> 
>> On Aug 17, 2015, at 12:21 PM, William Whyte wrote:
>> 
>> In fairness, NIST explicitly call this out themselves at
>> https://www.federalregister.gov/articles/2015/08/12/2015-19743/government-use-of-standards-for-security-and-conformance-requirements-for-cryptographic-algorithm:
>> 
>> NIST is also interested in feedback on the impacts of a potential U.S.
>> Government requirement for use and conformance using a standard with a
>> fee-based model where organizations must purchase copies of the ISO/IEC
>> 19790:2014.
>> 
>> William
>> 
>> On Sat, Aug 15, 2015 at 8:50 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie>
>> wrote:
>>> 
>>> 
>>> 
>>> On 15/08/15 12:24, David Lloyd-Jones wrote:
>>>> What is it you have "heard," Stephen, that has given Phil this avalanche
>>>> of
>>>> "reason to object"?
>>> 
>>> I already said that I have been told that the ISO spec is behind
>>> a paywall, that is all. And now I've said it twice:-)
>>> 
>>> Whether or not that's a deal for folks who've previously been
>>> willing to subject themselves to FIPS140 fun is a reasonable
>>> question. But it's also reasonable to point out that that is
>>> a barrier to broad, open review.
>>> 
>>> And of course, if you care about any of this, then telling
>>> NIST what you think is the correct action.
>>> 
>>> S.
>> 
>> 
>> 
>> _______________________________________________
>> saag mailing list
>> saag@ietf.org
>> https://www.ietf.org/mailman/listinfo/saag
>> 