Subject: RE: [Cfrg] Authenticated encryption primitive -- SOBER-128

From: Doug Whiting <[email-masked]>
Date: Thu, 15 May 2003 11:08:38 -0700

Yes, that would be fun indeed!

I don't think the issue is money as much as it is:
"who gets to make the final decision?"

In AES, it was always clear that NIST would make the decision,
and we were all happy with the final result, so the world went
that way.  That might be very hard to do, as we'd all have to
agree who we trust to do the right thing.  I don't think that
we could count on having a unanimous consensus.  

> -----Original Message-----
> From: Alex Alten [mailto:[email-masked]]
> Sent: Thursday, May 15, 2003 8:56 AM
> To: Doug Whiting; 'David Mcgrew'
> Cc: [email-masked]
> Subject: RE: [Cfrg] Authenticated encryption primitive -- SOBER-128
> 
> 
> At 01:20 PM 5/14/2003 -0700, Doug Whiting wrote:
> <snip>
> 
> >It would be great to have a "better" replacement for RC4.  I 
> just want
> >to make sure that we take our time and do it right, whatever 
> that means.
> >The AES process was so good that it's hard to settle for 
> anything less :-)
> 
> So why don't we, as in CRFG, do something like the NIST AES process?
> Let's list out our requirements and invite cryptographers to 
> submit design
> proposals.  Or is it a question of having enough money to do it?
> 
> - Alex
> --
> 
> Alex Alten
> [email-masked]
> 
> 
> 
_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: David Mcgrew <[email-masked]>
Date: Thu, 15 May 2003 11:34:59 -0700

Alex,

I also like the idea of running an AES-like contest - it would be lots of 
fun - but we also need to stay within our charter.  This includes "bringing 
new cryptographic techniques to the Internet community and promoting an 
understanding of the use and applicability of these mechanisms via 
Informational RFCs".    So we can identify the goals for a crypto algorithm 
and discuss the analysis of algorithms (and the right RG process for this 
is to write drafts).  But as Doug points out, it's not appropriate for us 
to select an algorithm for standardization.  As Steve Bellovin pointed out 
yesterday, IETF WGs do the real standardization work.  Of course, IRTF RGs 
are formed in the hope that they will do work that can feed into WGs.

It would be good to agree on a set of goals that are appropriate for SOBER, 
Helix, and similar functions.  If there's sufficient interest, the RG can 
write up a draft describing these goals.   I'd be interested to hear other 
people's thoughts on this.

David