Subject: [hrpc] Fwd: [] New paper from IGP on Standards and Human Rights

From: avri doria <[email-masked]>
Date: Tue, 1 Dec 2020 14:37:18 -0500

Hi,

Possibly interesting to some.

avri

-------- Forwarded Message --------

IGP releases a new research paper on the politics of the new Transport
Layer Security standard: Standardizing Security: Surveillance, Human
Rights, and TLS 1.3.

Standardizing Security develops a conceptual framework for understanding
the relationship between technical standards and political/social
effects. We identify three distinct ways of understanding this
relationship: 1) by examining the interest groups who shaped the
standard, which we call the Political Economy of Standardization (PES);
2) by focusing on the Societal Effects of Standards (SES) which refers
to cumulative effects of adoption and implementation decisions over
time; and 3) the idea that politics and rights are embedded in the
standard; i.e., that Protocols Have Politics (PHP). We then perform a
detailed analysis of the controversies around the design, adoption and
implementation of TLS 1.3.

We find that the PHP approach had limited explanatory value compared to
the PES and SES approaches. TLS 1.3 does in fact strengthen privacy –
and technical efficiency – if adopted and implemented as intended. But
the design of TLS 1.3’s stronger confidentiality measures met with
resistance from corporate network operators who wanted more visibility
into their internal networks and some governmental interests, leading to
the development of an alternate standard by ETSI. There are also
technical measures that can be deployed to undermine perfect forward
secrecy. Additionally, authoritarian governments are now taking measures
to block use of the new protocol. TLS 1.3 was an improvement, but its
effects were limited.

By conveying the idea that political, economic and social effects can be
hard coded into protocol designs, the protocols-have-politics view
short-circuits careful analysis of the way standards contribute to
governance. It also drastically overstates the role of protocol design
in internet governance. Rights advocates and internet governance
participants need to have more realistic ideas about what measures
advance human rights on the internet.

Download the paper here:
https://www.internetgovernance.org/wp-content/uploads/StandardizingSecurity-TLS.pdf
<https://www.internetgovernance.org/wp-content/uploads/StandardizingSecurity-TLS.pdf>

Dr. Milton L Mueller

Georgia Institute of Technology

School of Public Policy

IGP_logo_gold block

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 1 Dec 2020 23:13:12 +0000

Hiya,

> Possibly interesting to some.

Had a read. I think it's wrong as to the motivations
for TLS1.3 - Snowdonia was IMO only one of those, we
had had a long series of documented attacks on TLS
so TLS1.3 probably would've happened anyway because
of those and the potential RTT improvements. It also
ignores the role of academic cryptographers in the
process of developing TLS1.3 - their proofs and
formal methods and the tools they had for producing
those lead to some of the design choices rather than
any political anything.

There's also a few minor factual errors in the dramatis
personnae, and some omissions of relevant players.
I suspect those may have been driven by the tools that
we have available for re-constructing working group
histories post-facto, as talking to people involved in
the process should have avoided those. The errors
really are minor and of no real impact, but if they
are down to the methodology used by the authors, but
not described, that's a bit more of interest.

I've no opinion as to whether the history backs any
of the three theoretical explanatory frameworks or
not, but the paper's interesting as an example of a
reasonable but imperfect reconstruction of what
happened.

Cheers,
S.

> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Corinne Cath <[email-masked]>
Date: Wed, 2 Dec 2020 08:23:08 +0300

Hi,

I also read this paper and have some qualms with the bits that Stephen
didn’t speak to, i.e. the 3 part framework.

I think some of the work misreads STS approaches to protocol politics and
flattens the argument made by scholars who focus on the inherent power
dynamics of standardization.

I also would have liked to see a more elaborate methods section, such that
it becomes clear how the historic construction was done and why the authors
decided to do this seemingly without in-depth interviews with the
individuals involved.

Lastly, it’s good to note that this paper has not been peer reviewed yet.
Going through that process would, as with I-Ds, would probably help
straighten out some of the folds identified on this thread.

Kind regards,

Corinne

On Wed, 2 Dec 2020 at 02:13, Stephen Farrell <[email-masked]>
wrote:

> > <
-- 
Corinne Cath - Speth
Ph.D. Candidate, Oxford Internet Institute & Alan Turing Institute

Web: www.oii.ox.ac.uk/people/corinne-cath
Email: [email-masked] & [email-masked]
Twitter: @C_CS