[saag] Re: New Version Notification for draft-rsalz-crypto-registries-00.txt

[Simon Josefsson <[e-mail]>]

Peter Gutmann <[e-mail]> writes:

> Tero Kivinen <[e-mail]> writes:
>
>>When someone (like openssh) creates a new thing with [e-mail], they
>>should include the documentation of that either on their web page, or inside
>>the source distribution etc. Not everything needs to be an RFC, and most of
>>those things that are defined that way are quite simple to document.
>
> Ahh, no, this leads to the current mess where one of the OpenSSH folks invents
> something, posts it (without any public review) to the bottom of a locked
> filing cabinet stuck in a disused lavatory with a sign on the door saying 
> "Beware of the Leopard", it gets added to the de-facto standard SSH
> implementation that everyone has to be compatible with leading to a scramble
> to find out where it's specified and how you're supposed to implement it, and
> then a later scramble to patch it when the security vulns from the lack of
> public review are discovered.
>
> Looking at it from the other side of the fence, given the incredibly laborious
> and painful process of getting anything through the IETF (ISO standards are
> often considerably quicker and easier to do than IETF, and that includes the
> time for translation into French) I have some sympathy for the folks who
> choose to do it this way even if I don't really agree with what they're doing.

I share that sympathy.  We can help them by making the IETF a welcoming
place to get documents reviewed, improved and published.

I believe the IETF share the responsibility for things ending up in the
way you describe.

While it is easy to cast the blame on OpenSSH folks for doing the
actions, I believe the primary place to improve the outcome is in the
IETF.  It's not OpenSSH that should change, it's the IETF.

If the IETF had been a more attractive place to come to and get things
done, doing so happens naturally and automatically.

Unfortunately, I see diminishing interest in acknowleding or improving
this state.  Instead there appears to be strong interest in using the
powers to 1) delay, defer and stop publications (ssh-ntruprime, peap,
anything non-nist) and 2) publish specifications that are incompatible
with deployments which damages ecosystems (pgp), and 3) favor protocols
that lead to weaker system security due to complexity (ipsec, x509).

/Simon