Hi SM,
On 04/10/2014 09:54 AM, S Moonesamy wrote:
Hi Jari,
I sent a message to the IESG yesterday (see
http://www.ietf.org/mail-archive/web/ietf/current/msg87189.html ).
You ask in that message "why the delay?"
As I told you off list before you posted that, we are hoping that
CFRG will organise a virtual interim meeting for which the main
topic of discussion will be whether CFRG's advise the IETF that
some set of new curves (including that required by your draft)
are good enough for use in IETF standards. That question was
raised at the CFRG session in London but there were not enough
people in the room who felt they knew enough about the topic to
be sure. Aside from you the TLS wg are also waiting on that
answer. I hope the CFRG virtual interim will happen in the next
few weeks. That is the reason for delay.
If that CFRG meeting doesn't happen soon, (but I expect it
will) then I will organise some other way to get an answer on
this topic, but better if we can get folks who do crypto for
a living to give us an answer if we can.
Regards,
Stephen.
PS: I don't really know what the rest of you mail relates to
but feel free to explain off list if it needs a response.
As
the wasn't any response from the IESG there might be a perception that
the IESG isn't responsive to concerns when the matter affects OpenSSH
code. For what it is worth OpenSSH is widely deployed. It is easy to
assess whether what I wrote is true by looking at a few open source
operating systems.
It has been stated that:
'To break the deadlock, document authors often choose some "seemingly
unused" code points, often by selecting the next available value from
the registry; this is problematic because these may turn out to be
different from those later assigned by IANA. To make this problem
worse, "pre-RFC" implementations are often developed and deployed
based on these code point selections.'
I did not choose a "seemingly unused" code point (see
draft-moonesamy-sshfp-ed25519-01). I followed what the IETF
documentation says and the advice I have been given. I requested
feedback from CFRG even though it is not an IETF Working Group. I could
have objected to that given what has been said in the news.
According to RFC 2026:
"If an individual should disagree with an action taken by the IESG in
this process, that person should first discuss the issue with the
ISEG Chair."
The problem is that the IESG has not taken any action. In my opinion it
is constructive to be open to discussion.
Regards,
S. Moonesamy