Subject: [Cfrg] Obligations of Candor

From: Watson Ladd <[email-masked]>
Date: Sun, 15 Jun 2014 10:25:47 -0300

Dear all,

I would like to see an addition to the IETF rules: participants must
fully disclose security issues with the standard they are aware of, in
all standards bodies they participate in, at the time of the Last Call
for a standard. Such disclosure must be to all members of the
committee developing the standard, and, in the event such a security
issue remains post-ratification, public.

This is motivated by the discovery that Certicom, in particular,
patented a backdoor in Dual EC, and proceeded not to tell anyone. No
doubt I have bumbled the above rule: but I would like to start
discussion of what sort of rule we require to ensure that participants
do not horde vulnerabilities, only to exploit them after the standard
is ratified.

Sincerely,
Watson Ladd

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 15 Jun 2014 14:44:44 +0100

Hi Watson,

This is the wrong list for that as CFRG is not an IETF thing so
having that discussion here won't achieve what you'd like to
achieve.

I'd suggest [email-masked] to the extent you think this relates
specifically to security, or [email-masked] if you think its a
more general ethical issue.

Separate to that, the CFRG chairs or IRTF might also want to
have such a discussion of course, all I'm saying is that having
it on this list will not achieve the effect you're after in the
IETF.

Cheers,
S.

On 15/06/14 14:25, Watson Ladd wrote:
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
> 
>