Subject: Re: [Cfrg] Fwd: Last Call: draft-mcgrew-auth-enc (An Interface and Algorithms for Authenticated Encryption) to Proposed Standard

From: David McGrew <[email-masked]>
Date: Wed, 6 Jun 2007 11:26:15 -0700

Hi Peter,

the intent of the registry is to promote algorithm agility,  
especially for new applications that would not already have a  
registry in place.  In these cases, it is a nice convenience to have  
a registry that's already there, and in the long run, we might have  
fewer registries.   In protocols like those that you mention (S/MIME,  
PGP, SSL), I expect that they will just use their existing registries  
as you describe.

I had not thought that the registry could look discouraging to the  
algorithm designer, but I guess you're right that it might look like  
an additional bureaucratic hoop that needs to be jumped through.   
That is certainly not the intent.   Section 4, "Requirements on AEAD  
algorithms", makes no mention that an algorithm must be registered.   
Perhaps it would be a good thing to point out that algorithms that  
are intended for use in practice (i.e. ones that are not  
experimental) should be registered, and provide short instructions on  
how to do this, and mention that registration is desirable but not  
required.

best regards,

David

On May 31, 2007, at 7:44 PM, Peter Gutmann wrote:

>> The IESG has received a request from an individual submitter to  
>> consider
>> the following document:
>>
>> - 'An Interface and Algorithms for Authenticated Encryption '
>>    <draft-mcgrew-auth-enc-02.txt> as a Proposed Standard
>>
>> The IESG plans to make a decision in the next few weeks, and  
>> solicits final
>> comments on this action.  Please send substantive comments to the
>> [email-masked] mailing lists by 2007-06-28.
>
> What's the point of the registry?  SSL will define its own cipher  
> suites for
> this, S/MIME will need ASN.1 OIDs, PGP will use PGP algorithm IDs,  
> and so on.
> What purpose does having a registry serve, apart from providing one  
> more layer
> of paperwork for algorithm designers?
>
> Specifically, the current practice has been to publish some anchor  
> RFC "The
> XYZ Algorithm", and then anyone who wants it either adds it to  
> their main
> crypto-protocol RFC or tacks it on with "Use of the XYZ Algorithm in
> <protocol- name>" to provide the protocol-specific binding.  What  
> extra
> features does the registry provide?.
>
> (I have no objections to it being published, I'm just curious as to  
> what
> demand the registry is supposed to meet).
>
> Peter.
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg