Subject: Re: [perpass] mandatory-to-implement vs. more?

From: Tony Rutkowski <[email-masked]>
Date: Mon, 21 Oct 2013 06:14:47 -0400

Hi Eliot,

Apropos to your suggestion...

What about MTnI (mandatory to not implement) or MTB (mandatory to break)? Public networks and services have been subject to governmental controls on encryption by every country in international law since 1850. Individuals and small groups may be able to skirt the requirements, but not commercial or institutional providers. Seems like a bit of a scaling challenge?

--tony

Eliot Lear <[email-masked]> wrote:

>Stephen wrote:
>
>> I think the path forward is more like making opportunistic
>> security mechanisms (in particular confidentiality) more-than-MTI
>> in a way that builds in some security (against passive attacks)
>> as an inherent feature of new protocols, but also results in
>> a far easier transition from there to fully authenticated,
>> compared to the massive gap between cleartext and fully
>> authenticated.
>
>Teasing out OE from other potential tasks is a good thing; of that I'm
>convinced.  Whether it's more than MTI *or even MTI* depends on what
>recommendations can be made regarding how to do it.  A draft there would
>be most welcome (I've heard that some are thinking about doing something
>with OTR).
>
>Eliot
>_______________________________________________
>perpass mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/perpass

---

From: Eliot Lear <[email-masked]>
Date: Mon, 21 Oct 2013 12:28:00 +0200

Yes, and this begs a question about which encryption we're talking
about, as well.  While most of us see the world as AES, others see it as
GOST and yet others may have other algorithms they are required to use. 
Plain text may be the least common denominator in some cases, for
interoperability.  That doesn't mean we have to code to that case, but
we should at least recognize that if we don't there may be some sites
that become inaccessible to some class of users.

Eliot

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 22 Oct 2013 08:18:58 +1300

Tony,

> What about MTnI (mandatory to not implement) or MTB (mandatory to break)? Public networks and services have been subject to governmental controls on encryption by every country in international law…

I believe that is *exactly* why the IETF endorsed both RFC 1984 and
RFC 2804. It's *our* job to make our specs as secure as reasonably
possible and to not help make them liable to eavesdropping. If that
makes signals intelligence agencies unhappy, or presents implementors
with a conflict between an IETF "MUST" and a jurisdictional "MUST NOT",
that isn't our concern.

Here, I believe we should focus only on specifications that enhance
privacy, and IMHO that certainly includes specifying that implementations
must have strong privacy-protecting default configurations.

    Brian