Subject: [saag] Comments on "No MTI Crypto without Public Review"

From: Jon <[email-masked]>
Date: Sat, 9 Jul 2016 14:25:33 -0500

Greetings,

This email contains comments on the draft version of "No MTI Crypto without
Public Review" at
http://www.ietf.org/id/draft-rsalz-drbg-speck-wap-wep-01.txt

1)​  "...more IETF protocols are using, or looking at, cryptography to
increase ​privacy​ on the Internet..."

I like and agree with RFC7258  and I agree that encryption provides some
privacy benefits (mainly by increasing the amount of effort needed to
conduct useful traffic analysis, yes?), and I agree that public review
should be a MUST before implementing crypto.  However, the wording here
doesn't quite sound right - is it correct to say that cryptography is being
adopted in RFCs solely to increase privacy, or even to say that privacy
itself is the main driver?

Instead of "to increase privacy", what about something more specific, like
"increase data integrity and ease of endpoint authentication"?  Isn't it
technically more feasible to measure/quantify those qualities than
privacy?  If a public review of a new crypto method demonstrates that data
integrity is preserved and robust, and if the endpoints (user/user,
client/server) can authenticate themselves to each other in an easy and
non-falsifiable way, then can't it be said that the new method will provide
some level of confidence of privacy greater than previous crypto
implementations?

Maybe I'm splitting hairs with this thought, or maybe it's understood that
integrity and authentication are automatic results of strong crypto and
don't need to be explicitly stated.

2)  Under the section Terminology, the phrase 'mandatory to implement' is
missing hyphens, unlike its use elsewhere in the doc.

3)  'Snake oil' is defined and included in Terminology but it doesn't
appear to be used anywhere else - is it needed?  I understand the term and
its relevance but it reads like slang or a buzzword that's out of place in
an RFC.

4)  "Cryptography is becoming more important to the IETF and its protocols,
and more IETF protocols are using, or looking at..."

Depending on the history of crypto use in RFCs, would it be more accurate
to replace "is becoming" with "has become"?  Also, since the doc mentions
protocols plural, it would help to provide more examples of recent RFCs
that feature crypto.  For example, DNS over TLS -
https://tools.ietf.org/html/rfc7858

Thank you for the opportunity to comment.

Jon Jarvis

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Sun, 10 Jul 2016 11:26:24 -0400

(apologies for replying on an older thread!)

On Saturday, July 9, 2016, Jon <[email-masked]> wrote:

> Greetings,
>
> This email contains comments on the draft version of "No MTI Crypto
> without Public Review" at
> 4)  "Cryptography is becoming more important to the IETF and its
> protocols, and more IETF protocols are using, or looking at..."
>

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871