Subject: [lamps] Éric Vyncke's No Objection on charter-ietf-lamps-05-01: (with COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Thu, 20 May 2021 03:43:29 -0700

Éric Vyncke has entered the following ballot position for
charter-ietf-lamps-05-01: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-lamps/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

PQC is of course a must but I wonder why in 5.a only the US NIST algorithms
will be used ? Can we use a wording as in 5.b (i.e., not limiting ourself to US
NIST) ?

Regards

-éric

---

From: Roman Danyliw <[email-masked]>
Date: Thu, 20 May 2021 12:46:32 +0000

Hi Éric!

> -----Original Message-----
> From: iesg <[email-masked]> On Behalf Of Éric Vyncke via Datatracker
> Sent: Thursday, May 20, 2021 6:43 AM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; [email-masked]
> Subject: Éric Vyncke's No Objection on charter-ietf-lamps-05-01: (with
> COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> 

Per 5(a), this language is an attempt to be as specific as possible to ensure an narrow scope in the spirit of the long-standing principle in the second paragraph of the charter:

==[ snip
The LAMPS (Limited Additional Mechanisms for PKIX and SMIME) Working 
Group is chartered to make updates where there is a known constituency 
interested in real deployment and there is at least one sufficiently 
well specified approach to the update so that the working group can 
sensibly evaluate whether to adopt a proposal.
==[ snip

To ensure that LAMPS doesn't become an open-ended crypto maintenance group, LAMPS only takes on work where there is a tangible proposal (and no other WG can do the work).  As to only referencing US NIST PQC, that work is the only in-flight work that is reviewing PQ algorithms through an open review process that has caught the attention of the WG.  If there are other initiatives, I'm  confident that the WG would recharter to include it.

Per the language in 5(b):

==[ snip
5.b. NIST and other organizations are developing standards for 
post-quantum cryptographic (PQC) algorithms that that will be 
secure even if large-scale quantum computers are ever developed.  
However, a lengthy transition from today's public key algorithms to 
PQC public key algorithms is expected; time will be needed to gain 
full confidence in the new PQC public key algorithms.
==[ snip

That first sentence of "NIST and other organizations are developing standards for post-quantum cryptographic (PQC) algorithms that that will be secure even if large-scale quantum computers are ever developed" is just generally informative text not meant to imply scope for the WG to motivate the sub-bullets.  The specifics of relying on NIST and CFRG per 5.b.i and 5.b.ii are the normative guidance.

That first sentence can removed to eliminate ambiguity.

Regards,
Roman

---

From: Mike Ounsworth <[email-masked]>
Date: Thu, 20 May 2021 13:50:12 +0000

Hi Éric!

In the interest of being specific, do you have another set of PQC algorithms that are ready for inclusion in CMS and PKIX within the next 6 months? (ie where the standards are sufficiently mature?). 

We can always re-charter again when another set of algorithms becomes ready.

---
Mike Ounsworth

-----Original Message-----
From: Spasm <[email-masked]> On Behalf Of Éric Vyncke via Datatracker
Sent: May 20, 2021 5:43 AM
To: The IESG <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: [EXTERNAL] [lamps] Éric Vyncke's No Objection on charter-ietf-lamps-05-01: (with COMMENT)

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________
Éric Vyncke has entered the following ballot position for
charter-ietf-lamps-05-01: No Objection

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://urldefense.com/v3/__https://datatracker.ietf.org/doc/charter-ietf-lamps/__;!!FJ-Y8qCqXTj2!IB0B5_kvjReOXHAwjmv7uPfBHo8qWNpbZM-i6y4_NCG-b7vKsyWlGq46MfAS0CILEvj9t8B2ZA$ 

PQC is of course a must but I wonder why in 5.a only the US NIST algorithms will be used ? Can we use a wording as in 5.b (i.e., not limiting ourself to US
NIST) ?

Regards

-éric

_______________________________________________
Spasm mailing list
[email-masked]
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!IB0B5_kvjReOXHAwjmv7uPfBHo8qWNpbZM-i6y4_NCG-b7vKsyWlGq46MfAS0CILEvgqPjB1mA$