[saag] Re: New Version Notification for draft-rsalz-crypto-registries-00.txt

["D. J. Bernstein" <[e-mail]>]

Paul Wouters writes:
> D. J. Bernstein <[e-mail]> wrote:
> > Paul Wouters writes:
> > > The rough consensus is that there is no appetite for NTRUprime.
> > Um, what? There are multiple interoperable NTRU Prime implementations
> > for SSH, plus NTRU Prime implementations for various other protocols.
> > The SSHM WG adopted draft-josefsson-ntruprime-ssh earlier this month:
> i was talking about the IETF, not SSH.

IETF consensus is established only through IETF procedures. It's
interesting to see the juxtaposition between

    * IETF lawyers obviously being increasingly concerned about IETF's
      liability under antitrust law (see RFC 9680; I'm also sending this
      message to an RFC 9680 coauthor for IETF LLC attention) and

    * an AD, after indisputably being informed that a WG has adopted an
      NTRU Prime document, issuing false claims of IETF consensus "that
      there is no appetite for NTRUprime".

Very similar fraud by a committee chair was the reason that ASME,
another standardization organization, ended up paying 4.75 million
dollars in the Hydrolevel court case, the equivalent of about 15 million
dollars today. ASME per se wasn't engaging in fraud; the reason it lost
is that it didn't have sufficient controls in place to prevent the chair
from using the chair's seeming ASME authority to suppress competition.

> > Instead the ADs seem to be _encouraging_ having Kyber as
> > the only post-quantum encryption option.
> That is willful misrepresentation.

You're on record claiming, e.g., that "the cryptographic research
communities are focusing on NIST candidates ... Should the IETF really
recommend a dropped candidate at this stage? I do not think so". The
only PQ encryption mechanism that NIST has standardized is Kyber, so
this do-only-what-NIST-does position is encouraging Kyber as the only PQ
encryption option for IETF too.

You're also on record responding to the Kyber patent mess by claiming,
e.g., that the "process for deciding on cryptography is a separate
process" somehow exempting cryptography from BCP 79. You didn't back
down on this claim even after

    https://mailarchive.ietf.org/arch/msg/saag/pKLdOqJpiyZDIrqJjrFuD65tWUc/

gave a quote from Scott Bradner to the contrary. Ultimately what matters
is that you seem to be letting Kyber specs sail through while throwing
obstacles in the way of other options.

Sure, the future situation might be different if NIST standardizes other
options (as I hope it does) and the ADs start encouraging usage of those
options. My comment was about the current situation.

---D. J. Bernstein