Re: [secdir] [Cfrg] Time to recharter CFRG as a working group? Was: Re: ISE seeks help with some crypto drafts

Dear Mike,

Thanks for sparking this discussion (and thanks to everyone else for engaging). The chairs have been following with interest, and have welcomed the opportunity for questions about the future constitution of CFRG to be aired.

The rough consensus of those who joined the discussion is that we should leave the status of CFRG as it is for now. 

Of course, this kind of question can and should be revisited in future. Triggers for that might include: the workload of the RG increases significantly; a spate of IPR issues arises;  the nature of the work being done in the RG changes further. (This list is intended to be illustrative rather than exhaustive.) At such a point, we can discuss again and invoke the formal procedures of the IRTF and IETF to effect changes.

Regards,

Kenny (for the chairs)

-----Original Message-----
From: Cfrg <cfrg-bounces@irtf.org> on behalf of Michael StJohns <msj@nthpermutation.com>
Date: Friday, 15 March 2019 at 18:53
To: Richard Barnes <rlb@ipv.sx>
Cc: secdir <secdir@ietf.org>, "cfrg@irtf.org" <cfrg@irtf.org>, "RFC ISE (Adrian Farrel)" <rfc-ise@rfc-editor.org>
Subject: Re: [Cfrg] Time to recharter CFRG as a working group? Was: Re: [secdir] ISE seeks help with some crypto drafts

    On 3/13/2019 7:32 AM, Richard Barnes wrote:
    > Mike, are your concerns here primarily IPR related?  If that's so, 
    > then maybe that's the level at which we should address them, as 
    > opposed to flipping the bigger RG->WG switch.
    >

    Hi Richard -

    Like I said, I'm not going to push this at this time.  But I think its 
    more than just IPR - avoiding technology because of IPR is more a 
    symptom (and in fact is IETF guidance rather than IRTF policy).

    The CFRG has a unique position in that - unlike ANY other RG as far as I 
    can tell - it's looked at as an immediate feeder for technology for the 
    IETF.  If it were agnostically evaluating the crypto properties of any 
    offered technology, I'd say we're good and I'd move on.  But, with the 
    publication of Curve25519 and its related ... standards ..., the CFRG 
    has moved from evaluation and re-publication of cryptographic standards 
    developed and produced elsewhere into being the first publisher of what 
    could only be characterized as standards, even if published as an 
    Informational RFC in the IRTF stream.

    Ultimately, I think it comes down to fairness and transparency. As an 
    RG, the publications of the RG are not subject to the standards appeals 
    process.  In an WG, the decision not to work on an IPR encumbered 
    technology (or others such as national cryptography) MAY be appealed and 
    overturned (or might not) or sponsored by an AD if there's no applicable 
    or agreeable WG. There's a process for showing such decisions were made 
    transparently, and with a broader audience than just the CFRG having a say.

    Later, Mike

    Ps - hmm... Note that the CFRG charter only mentions the IETF and not 
    the IRTF....

    _______________________________________________
    Cfrg mailing list
    Cfrg@irtf.org
    https://www.irtf.org/mailman/listinfo/cfrg