Subject: nation state crypto profiles - draft-jenkins-cnsa-cmc-profile-00

From: Paul Wouters <[email-masked]>
Date: Fri, 28 Sep 2018 15:23:49 -0400 (EDT)

I just noticed this draft:

Commercial National Security Algorithm (CNSA) Suite Profile of Certificate Management over CMS

https://tools.ietf.org/html/draft-jenkins-cnsa-cmc-profile-00

We had a discussion in the past where it seems a bunch of people thought
that publushing RFC's with specific nation states profiles was no longer
deemed neccessary or wise. It looks like this publication should be a
FIPS document, not an RFC.

This was for instance, discussed here:

https://mailarchive.ietf.org/arch/msg/ietf/Gfo9si95rem3UtzGlEn9-AK22ro

Some of the text is also very wrong, such as:

    NSA is publishing a set of RFCs, including this one, to provide
    updated guidance concerning the use of certain commonly available
    commercial algorithms in IETF protocols.

The IETF publishes RFCs, not the NSA. It is another sign that this is
the wrong venue for publishing what they want to publish.

Paul

---

From: Russ Housley <[email-masked]>
Date: Fri, 28 Sep 2018 15:30:54 -0400

> On Sep 28, 2018, at 3:23 PM, Paul Wouters <[email-masked]> wrote:
> 
> 

Paul:

That thread came to the conclusion that the IETF should not process profiles for any nations states.   In my opinion, there is value in making it easy for implementers to find such profiles.  So, if the Independent Stream Editor is willing to process such profiles, they can be published as RFCs, which would not consume any resources from the IETF leadership.

Russ

---

From: Paul Wouters <[email-masked]>
Date: Fri, 28 Sep 2018 15:40:46 -0400 (EDT)

> That thread came to the conclusion that the IETF should not process profiles for any nations states.   In my opinion, there is value in making it easy for implementers to find such profiles.  So, i…

I do not agree the thread came to that conclusion. I see people
disagreed and stop the discussion, because everyone agreed the
draft in question to make Suite B historic was not disputed.

People outside the IETF do not understand the subtleties of different
IETF streams, and having an RFC is seen as a stamp of approval of
the international community. Therefore, I do indeed believe we should
not make the same mistake again.

The USG seems to be doing a fine job making FIPS publications available
without these being enshrined in RFCs.

I am against the IETF publishing CNSA or any other nation state
cryptography profiles.

Paul

---

From: Michael Richardson <[email-masked]>
Date: Sat, 29 Sep 2018 15:46:16 -0400

> not make the same mistake again.

I agree with Paul.

Further, it makes it look like the NSA has a priviledged position,
particularly when it writes things the way it did.

    > I am against the IETF publishing CNSA or any other nation state

As am I.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 30 Sep 2018 18:19:07 -0500

> That thread came to the conclusion that the IETF should not process profiles for any nations states.   In my opinion, there is value in making it easy for implementers to find such profiles.  So, i…

With apologies for nitpicking, phrased this way as an absolute it is false
-- the IESG would still do a conflict review of the ISE document(s).

-Ben