Subject: [Cfrg] Enough already!

From: Watson Ladd <[email-masked]>
Date: Tue, 27 Jan 2015 08:42:31 -0800

Does anyone have any security objection to what's in the original TLS draft?

So why can't the TLS WG proceed with it?

Are we seriously going to spend another month (if we're lucky!)
arguing about endianness?

This is a catastrophe we should be sure not to repeat at higher
security levels by making rules and having a competition as opposed to
go play a game of Calvinball.

If we can't expeditiously answer basic questions in a reasonable
timeframe, people are going to avoid asking those questions. And they
are going to be worse off for it. The CFRG was sorely underutilized in
the past: I don't see any reason why a IETF WG would ask us anything
now.

A month ago I accused the chairs of continuing the farce. That was too
nice: it's a full-blown fiasco now. And I don't see any plans to avoid
it in the future. A year later, and we have a starting point with
unspecified future changes being considered, and arguments that popped
up over that year, coming back to life.

Is there a definite time at which we will be well and truly done?

Sincerely,
Watson Ladd

---

From: "Dan Harkins" <[email-masked]>
Date: Tue, 27 Jan 2015 08:59:47 -0800 (PST)

> the past: I don't see any reason why a IETF WG would ask us anything

  -1

  We are answering basic questions, you just don't like the answers.

> up over that year, coming back to life.

  Apparently your naiveté has finally been confronted with reality. Last
year I told you it would take something like 2 years to get an RFC published.
You said no, it should only take 30 minutes. This is how sausage gets
made.

  Dan.

---

From: Watson Ladd <[email-masked]>
Date: Tue, 27 Jan 2015 09:20:44 -0800

>   We are answering basic questions, you just don't like the answers.

And what question would that be? We've devoted far more energy to
which byte goes first then to discussing the merits of various
signature proposals.

> You said no, it should only take 30 minutes. This is how sausage gets

No, this is how bikesheds get painted. Are you seriously thinking this
is preferable to a contest with requirements on timing and content of
proposals for the higher security levels?

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 27 Jan 2015 09:51:53 -0800

> You said no, it should only take 30 minutes. This is how sausage gets

Oh, please. This is only how sausage gets made badly. Other groups, when asked to say what is and is not secure, don't stop and lecture people about how we used to do it.

--Paul Hoffman

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 27 Jan 2015 12:59:17 -0500

On Tue, Jan 27, 2015 at 12:51 PM, Paul Hoffman <[email-masked]>
wrote:

> Oh, please. This is only how sausage gets made badly. Other groups, when
> asked to say what is and is not secure, don't stop and lecture people about
> how we used to do it.
>

+1

If we are doing ASN.1 then we do endian-ness the way it specifies in ASN.1
and PKCS#1. We have routines for pulling bignums out of BitString and
OctetString structures and using them in all the crypto libs already.

I must have known that at several points in my life as I have implemented
X.509 in javascript, C# and C, some languages more than once. But I always
forget it immediately after.

Network byte order is irrelevant here. It is consistency with all the rest
of the widely used crypto that is the concern. Widely used means RSA. I
don't much care about any other EC formats.