Re: [secdir] [Cfrg] Time to recharter CFRG as a working group? Was: Re: ISE seeks help with some crypto drafts

[Daniel Kahn Gillmor <[e-mail]>]

On Tue 2019-03-12 16:43:04 -0400, Michael StJohns wrote:
> The last couple of discussions have been about the IPR related to OCB
> and whether the CFRG should work on it because of that.  That's a
> perfectly fine set of discussions for a standards WG especially when
> considering which modes to include under recommended and mandatory to
> implement, but is probably out of place for an RG.  The RG ought to be
> answering the question "does this proposal have security flaws" and
> not "has the patent expired on this" but we seem to be getting far
> past the "discussing and analyzing" part of the CFRG charter?

I'm not convinced by this line of argument.

This group answers not only "does this proposal have security flaws?"
but also "can it/will it be deployed effectively, with the security
properties we want?"  See Tony Arcieri's excellent analysis of the
tradeoffs between different modes earlier in this thread for an example.
That kind of question is not out of place for a research group -- that's
exactly the kind of practical, useful analysis we'd like to see, and i
wish all research groups were so productive.

Sadly, we live in a world where "IPR" concerns also have an impact on
this latter question, and the CFRG happens to have a pool of people with
a significant amount of knowledge about the history of cryptographic
development and deployment, some of which is occasionally useful in
analyzing IPR issues, frustrating though they may be.  It's not out of
place for the CFRG to include that aspect in its analysis.

The CFRG is working well, and has had a significant, positive impact on
the IETF over the last several years.  If adding the ability to make
"standards track" documents would help the CFRG further help the IETF,
or could encourage additional useful participation in the CFRG, let's
discuss how to do that, but i there's no need to make a constitutional
change to the CFRG just because IPR issues come up occasionally here.

       --dkg