[saag] Re: The curve mess, and lessons for more crypto

[John Mattsson <[e-mail]>]

Michael Richardson wrote:
>I also think that we shouldn't elevate NIST to a position above other national standards bodies."
We definitly should not. Doing so severely hurts the view of IETF as global SDO. That said I think there are very different types of comments when referring to NIST:

1. IETF should not specify use of NTRU Prime as NIST is soon producing an open-access specification of the superior ML-KEM.

2. IETF should not use the superior X25519, Argon2, Adiantum etc. as NIST only allow P-256, PBKDF2, XTS-AES.

I strongly agree with 1 but I think comments like 2 should be ignored.

Watson Ladd wrote:
>For the past 9 years we've all tried to forget the fiasco
I don't know about the process, but the outcome was definitly not a fiasko. RFC 7748 and 8032 have seen use in TLS, 5G, IPsec, etc. much/none of that would not have happened without a CFRG specification. My company is fine with a NIST or CFRG open-access specification, but would very likely not have used Curve25519 or X448 without a CFRG specification.

Watson Ladd wrote:
>Therefore we should avoid having contests
I agree, contests leads to very little collaboration and a lot of people are sore losers.

Stephen Farrell wrote:
>FWIW, I definitely do think the IETF ought document reality when that reality is widespread use of some credible cryptographic scheme, e.g. for SSH.

To some degree, but SSH is a weird case. SSH is an IETF standard but SSH companies are driving almost everything outside of the IETF. You can't have your cake and eat it too. Either discussions should happen in the IETF or SSH should no longer be an IETF standard. Right now IETF is giving prestige to protocol that more and more is a propriatary protocol developed outside of the IETF.

Cheers,
John