[saag] Re: on derivative work rights statements in emails to Security Area mailing lists

Stephen Farrell <[email protected]> Fri, 21 Nov 2025 22:17:33 +0000
Newsgroups	gmane.ietf.saag
Message-ID	<[email protected]>
Hiya,

On 21/11/2025 21:49, Christian Huitema wrote:
> 
> I think this boils down to an argument about power and authority of the 
> IETF. Should the working groups act as gatekeeper and use their 
> authority to "absolutely not allow" deployment of algorithms that they 
> find inappropriate for the Internet? That would mean, of course, 
> instructing IANA that only algorithms approved by Working Groups should 
> be allocated code point. The problem with that is whether the IETF has 
> enough moral authority to make such decisions stick. Sometimes it does 
> -- see for example the rejection of various proposals to weaken 
> encryption in TLS. If a substantial consistency wants to deploy 
> something and the only thing standing in their way is a code point 
> allocation experience shows that they will just squat on some random 
> value, thus leading to a worst of both worlds. The IETF did not stop the 
> deployment, and the squatted code point ends up having to be reserved to 
> avoid collisions with existing deployments.
> 
> That's why I personally think that the IETF should concentrate on making 
> sure that safe algorithms can be easily deployed, rather than attempting 
> to use the IANA as a gatekeeper. In the particular dispute between 
> hybrid and non-hybrid, that means publishing and endorsing a good hybrid 
> solution.
> 
> By the way, the debate is not just about hybrid versus non hybrid. There 
> is also a debate about how much deference the IETF should have to NIST. 
> If we end up only recommending the technologies that NIST approved, then 
> NIST becomes a single point of failure. Maybe we are OK with that 
> because there are no credible alternative. Or maybe not.

I generally agree with Christian.

There are two other things we could do:

- not endlessly appeal about nonsensical process stuff, nor answer
   appeals as if the nonsense wasn't nonsense, while not addressing
   the issue that's the topic of this mail (I guess I can't help with
   that though;-)

- provide guidance saying we prefer hybrid KEMs for now (e.g. a thing
   like [1] :-)

Cheers,
S.

PS: The dispatch sort-of outcome for [1] was to bring it to this list
and I plan to see if I can make the text better and see how much people
(dis)like it next week-ish.

[1] https://datatracker.ietf.org/doc/draft-farrell-tls-pqg/

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]
OpenPGP_signature.asc (application/pgp-signature, 236 B)