Re: [saag] SSH & Ntruprime

[Paul Wouters <[e-mail]>]

On Mon, Apr 15, 2024 at 6:42 PM D. J. Bernstein <[e-mail]> wrote:

> Paul Wouters writes:
> > Should the IETF really recommend a dropped candidate at this stage?
>
> Yes. IETF policy prefers algorithms with no known patent claims. BCP 79
> does not authorize delegating IETF's patent-related decisions to NIST.
>

A BCP does not authorize or not authorize anything. You keep quoting IPR
policy
without putting it in the proper context. It deals with protocols developed
within
the IETF, eg during the working group process. The process for deciding on
cryptography is a separate process with separate concerns, specifically
because
the IETF does not consider itself to be a full blown academic community
capable
of evaluating all cryptography.

   * While I agree that the review did make technical comments regarding
>      an issue beyond sntrup (the choice of combiner), those comments are
>      not even marginally consistent with how combiners are being handled
>      elsewhere in IETF and IRTF. (In case readers are interested in the
>      details, see postscript below.)
>

The IETF uses the CFRG and the Crypto Panel to inform itself on matters
related to cryptography. I believe that consensus process should not be
bypassed by the individual AD Sponsoring mechanism.

More to the point, my description of the review had nothing whatsoever
> to do with the identity of the reviewer, so it wasn't an ad-hominem
> attack. Please withdraw your claim to the contrary.
>

I stand by my view that your statement calling the Crypto Panel Review
"political" was unsubstantiated. I believe they handled the IETF process
properly and objectively within the constrains of the IETF process.


> > Some people prefer to not engage with you due to previous negative
> > experiences with your method of discussion.
>
> Now _that's_ an ad-hominem attack. Please (1) apologize and (2) keep
> yourself under control in the future. Thanks in advance.
>

I understood this was a possible reply to my clarification, but
unfortunately I
was in a difficult position. I could either withhold the information and be
accused non-transparency, or I could disclose the limited information and
be told it is an ad-hominem attack. I choose the more transparent option,
so that others could use their own judgement based on their own knowledge
along with their judgement based on my own personality traits. Thanks in
advance
for understanding the choice I made.

Also, have you considered the possibility that the conclusions in those
> conversations come from underlying errors that would be corrected if the
> arguments were raised in public? Look at the above "scrutiny" claim:
> it's the sort of error that can easily be repeated because it _sounds_
> reasonable, but transparency allows the claim to be rapidly debunked.
>

No, I have confidence in the claims. Furthermore, this discussion itself
has been
extremely aggressive and unpleasant and not inductive of cooperation.
Indeed, if
I were not an AD and felt it was required of my role to discuss, I would
have silently
disengaged a while ago.

As stated before, I am not willing to AD sponsor a document using
cryptography that is
not recommended by CFRG. I believe it is prudent that getting an RFC number
follows
the IETF practices and policies. It is what gives RFC numbers its value to
the community.
It is not up to me individually to override that process.

The SSH IANA registry policies were updated recently by RFC 9519 from IETF
Review to
Expert Review. You do not require an RFC to obtain an NTRUprime entry in
the IANA SSH
Key Exchange Registry. You can engage with the Designated Experts of the
SSH registries:
https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml

If you believe these is additional value in getting an IETF assigned RFC
number, you would
obviously agree that is value comes from its proven track record in the
past for following its
own process and policies. The process related to cryptography in the IETF
might be discussed
and clarified at the next IETF meeting in Vancouver due to other items that
have come up in
the last year. You are welcome to attend like any other IETF participant
via paid registration for
the IETF 120 conference.

This email ends my involvement in the discussion regarding AD Sponsorship
of this document.

Paul