Re: [TLS] On the difficulty of technical Mandarin (SM3 related)

[David Hook <[e-mail]>]

For what it's worth we on the Bouncy Castle project have managed to
implement most of the SM* standards already. I'll admit there were some
minor language issues (ignorance on our part), but for most of us I
think we'd agree that maths and tests vectors (while still based around
ASCII Hex/base64) are really quite familiar in any language (now at
least) and in most cases all that are required to produce a working
implementation. So we believe our C#, Java APIs, and Kotlin APIs can
already produce signatures, and certificates, in line with the current
draft for SM TLS 1.3 Cipher Suite already. We'd certainly welcome
feedback on whether we've been successful as well. The code is available
under https://github.com/bcgit

I would stress that this is not to say that there are not subtletys
around parameter choices that can be missed in trying to manage a
standard in another language (parameter choices that can affect security
for example), but if the first stage is interop and there is a mechanism
for validation, interop can easily dealt with. After that it's about
validation. Validation is going to be about something that rules  out
invalid parameter choices and chooses representative test vectors. It's
rarely about a standards document though.

I can understand the pain about the cost of ISO standards as well, but
having gone down the FIPS path also one realizes it's more about what
you test against than where you got the description of what you
implemented from, to that end a "not so definitive standard" can fill in
the gap. Even if you have the definitive reference it's still easy to
get it wrong, sometimes standard authors don't write the things we need
to hear, ultimately it's really about testing and analysis.

Regards,

David

On 28/8/19 10:24 pm, Hubert Kario wrote:
> On Monday, 19 August 2019 17:05:06 CEST Watson Ladd wrote:
>> Dear all,
>>
>> I see no reason why English alone should be accepted for standards
>> documents we reference. French and German pose few difficulties, and one
>> can always learn Russian.
>>
>> What I don't know is how difficult Mandarin is at a level to read a
>> standards document. I expect the mechanics of using the dictionary to
>> dominate.
> I am familiar with few languages, the issue is even finding dictionary able to 
> translate the technical terms correctly. Specialist texts are full of jargon 
> and jargon is very hard to translate correctly. It's not as simple as chucking 
> the text sentence by sentence at google translate[1] and fixing few grammar 
> mistakes.
>
>> I'm concerned about the traceability of unofficial Englidh PDFs on some
>> website: could the Chinese body responsible host them instead?
>>
>> I fully expect this to be a more general IETF problem.
> one of the primary objectives of IETF is interoperability
>
> given that, and the fact the the TLS specification is written in English, 
> there should be a specification of any algorithm that is supposed to be 
> integrated with it and published under the auspice of IETF to also be 
> available in English
>
> it's a matter of practicality, not politics
>
>  1 - other automated internet translation services are available
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls