Re: [saag] NIST requests comments on using ISO/IEC 19790:2012 as the U.S. Federal Standard for cryptographic modules

[Stephen Farrell <[e-mail]>]

Hiya,

On 17/08/15 23:31, Russ Housley wrote:
> I think it would be stronger if these comments went to NIST from the
> IETF Security Area Directors or the IESG.

Fair enough, I'm happy to chat with Kathleen and see how
best to process a statement if you or someone has time to
draft a bit of text. Or if nobody does I'll try get to it
next week if Kathleen doesn't beat me to it. (I at least
may need reminding - so please bug me if nothing appears
to happen a lot;-)

I don't think it'd be right for the IESG to send but I'm
happy to chat with the IESG and IAB to find a way to get
the message sent. (*)

Regardless of whose name is on the "From" line of the
message, I'd be happy if the text had been seen and not
found objectionable on this list. (If objections are
raised here we can figure out what to do about 'em.)
And of course, after some text has been crafted here it
might get tweaked by e.g. the IAB or someone but I'd
make sure they know that this list was involved in the
generation of the text and ask that they check any such
edits.

S.

(*) For the sensible amongst you who don't get involved in
IETF process stuff, the IAB are (amongst other things) the
foreign-office and might rightly be a bit irked if the IESG
(amongst other things, the home-office) started stepping on
that toe. Apologies for the .gov.uk terminology but I figure
the Irish analogues wouldn't be as well known:-)

> 
> Russ
> 
> 
> On Aug 17, 2015, at 4:33 PM, Richard Barnes wrote:
> 
>> On Mon, Aug 17, 2015 at 2:48 PM, Russ Housley
>> <[e-mail]> wrote:
>>> It is not clear to me that the use of ISO/IEC 19790 offers any
>>> improvement for the people that make crypto modules or the people
>>> that purchase crypto modules.  The specification being behind a
>>> paywall means that fewer people will know what it says.  Since
>>> the existing FIPS documents are freely available online, this
>>> seems to me to be a move in the wrong direction.
>> 
>> +1, but presumably these comments should be going to some NIST
>> channel?
>> 
>>> 
>>> Russ
>>> 
>>> 
>>> On Aug 17, 2015, at 12:21 PM, William Whyte wrote:
>>> 
>>> In fairness, NIST explicitly call this out themselves at 
>>> https://www.federalregister.gov/articles/2015/08/12/2015-19743/government-use-of-standards-for-security-and-conformance-requirements-for-cryptographic-algorithm:
>>>
>>>
>>> 
NIST is also interested in feedback on the impacts of a potential U.S.
>>> Government requirement for use and conformance using a standard
>>> with a fee-based model where organizations must purchase copies
>>> of the ISO/IEC 19790:2014.
>>> 
>>> William
>>> 
>>> On Sat, Aug 15, 2015 at 8:50 AM, Stephen Farrell
>>> <[e-mail]> wrote:
>>>> 
>>>> 
>>>> 
>>>> On 15/08/15 12:24, David Lloyd-Jones wrote:
>>>>> What is it you have "heard," Stephen, that has given Phil
>>>>> this avalanche of "reason to object"?
>>>> 
>>>> I already said that I have been told that the ISO spec is
>>>> behind a paywall, that is all. And now I've said it twice:-)
>>>> 
>>>> Whether or not that's a deal for folks who've previously been 
>>>> willing to subject themselves to FIPS140 fun is a reasonable 
>>>> question. But it's also reasonable to point out that that is a
>>>> barrier to broad, open review.
>>>> 
>>>> And of course, if you care about any of this, then telling NIST
>>>> what you think is the correct action.
>>>> 
>>>> S.
>>> 
>>> 
>>> 
>>> _______________________________________________ saag mailing
>>> list [e-mail] https://www.ietf.org/mailman/listinfo/saag
>>> 
> 
> _______________________________________________ saag mailing list 
> [e-mail] https://www.ietf.org/mailman/listinfo/saag
> 
>