Re: [saag] NIST requests comments on using ISO/IEC 19790:2012 as the U.S. Federal Standard for cryptographic modules

[Stephen Farrell <[e-mail]>]

On 18/08/15 14:47, Richard Barnes wrote:
> On Tue, Aug 18, 2015 at 5:33 AM, Phil Lello <[e-mail]> wrote:
>> I'd just like to clarify that my objection to the paywall isn't about paying
>> for the standard per-se, as it would be reasonable to pay a fee as an
>> implementor (much like paying to access C++ standards to write a compiler).
>> The objection is specifically about needing to pay to access the standard as
>> part of a review process, as the fee is a barrier to broad evaluation.
> 
> Well, then let me explicitly disagree with this position.  The
> standards that run the Internet need to be widely implemented, and
> that means the specs need to be widely available.  As Russ observed,
> the current FIPS standards are freely available, so moving to a
> paywalled standard would be a major step backwards.  And a step
> backwards for, AFAICT, no benefit.

One of the reasons I asked if someone was willing to take a
1st cut at drafting some text is that, since I am not going
to be reading the document behind the paywall, I have no clue
if Richard is correct when he says "for, AFAICT, no benefit."
(Since I've not read the thing;-)

If an IETF/IAB/IESG/whatever response really ought also say
something about the technical content, as well as the open-ness
aspect of the process, then I at least will be depending on
folks who have peeked behind that particular curtain to see
what the wizard looks like. Or if none of us do, then I guess
we could say that:-)

Cheers,
S.


> 
> I would also observe that "free for review, pay for implementation" is
> not really a realistic position.  If anyone can download the spec for
> review, then it will be out there on the Internet after it's
> finalized.  Much like the C++ spec, in fact (see the links in
> https://en.wikipedia.org/wiki/C%2B%2B).  And in practice that just
> means that everyone will use the free "almost final" version, not the
> paywalled "final" version.
> 
> --Richard
> 
> 
>>
>> Phil
>>
>> On Tue, Aug 18, 2015 at 1:37 AM, Mark D. Baushke <[e-mail]> wrote:
>>>
>>> It may be worth noting that NIST actually put the wrong edition of the
>>> ISO/IEC standard in the Federal Register article... They intended to put
>>> 19790:2012 instead.
>>>
>>> See also
>>>
>>>   http://csrc.nist.gov/groups/STM/cmvp/notices.html
>>>
>>>            -- Mark
>>>
>>> _______________________________________________
>>> saag mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/saag
>>
>>
>>
>> _______________________________________________
>> saag mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/saag
>>
> 
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag
> 
>