[saag] Re: The curve mess, and lessons for more crypto

[Michael Richardson <[e-mail]>]

Watson Ladd <[e-mail]> wrote:
    > For the past 9 years we've all tried to forget the fiasco that was the
    > process leading up to the publication of RFC 7745. It ruined several
    > collegial relationships: I understand some people don't talk to each

I didn't know it was that bad.

    > To my mind the fundamental lesson is that the IETF/IRTF consensus
    > model does not do well when one proposal must win. Furthermore, as we
    > aren't the protocol police, winning doesn't actually do much to
    > advance what happens or change the Internet. Therefore we should avoid
    > having contests and choose to let participants in the ecosystem decide
    > what of several equivalent proposals will survive. This suggests being
    > much more lax about WGs introducing crypto proposals and selecting
    > them than some views I've heard expressed, because we really cannot
    > effectively say no, and saying "only one must survive" does a lot of
    > damage.

As a consumer of CFRG and NIST opinions, I am not sure I agree with the many
flowers in the field view of things.  (There is a more precise quote from
Scott Bradner, going back to when he was an AD)

    > Now, I want to treat lightly and not ascribe positions to people they
    > don't actually hold, but I've seen people say no, CFRG should continue
    > to bless winners/we should defer to NIST. Working groups shouldn't
    > adopt drafts calling for cryptography outside of that. Or at least
    > that's my understanding of what's been discussed, not just in regards
    > to SSH but also in regards to the future of CFRG. And I see the issue
    > with snakeoil and wanting to bring some degree of clarity to complex
    > decisions about what to do, but I think that this cure is worse than
    > the disease.

I think that I agree: this cure is worse.

I also think that we shouldn't elevate NIST to a position above other
national standards bodies.  "First among equals" perhaps.
Companies that want to sell to us.gov will need to pay attention to NIST, and
naturally we should have code points.


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide