Subject: Re: [saag] draft-iab-crypto-alg-agility-01.txt

From: Peter Gutmann <[email-masked]>
Date: Wed, 15 Apr 2015 08:55:59 +0000

Stephen Farrell <[email-masked]> writes:

>There is also a lot of (IMO) wasted effort when someone is tasked to get
>their national alg "into" IETF specs. Someone probably has to translate into
>English/I-D and get all the required permissions, and that can take years,
>literally. (And when done, then start over on the next generation of national
>alg.)
>
>Then they need to negotiate all the fun of the baroque IETF and IANA
>processes we have setup for TLS, IPsec, S/MIME, PGP, SSH, ... in order to get
>all the relevant code points.

Isn't that a feature?  If it wasn't for that, we'd have TLS cipher suites for
the national ciphers of Lesotho, Tuvalu, Burkina Faso, and Bhutan.

Peter.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 15 Apr 2015 09:59:32 +0100

b

> the national ciphers of Lesotho, Tuvalu, Burkina Faso, and Bhutan.

Yes, it currently is a feature IMO. (Where we treat 'em all the
same and it's equally onerous.)

But I figure if we (and they) didn't have to even bother, (if all
such used one "proprietary" codepoint) that might be a better
feature. That is of course speculation for now, it'd need more
thought before we took that route.

S.

---

From: ianG <[email-masked]>
Date: Wed, 15 Apr 2015 15:28:21 +0100

> same and it's equally onerous.)

The feature is called 'barrier to entry' in economics, following from 
Porter's 5 forces model of industrial competition.  The quick story is 
that the incumbents build up a variety of barriers to slow new entrants 
into the market, then they are all more able to raise prices for their 
own benefit in a coordinated fashion.

The incumbents in this case can be the corporates who ship hardware, the 
browsers, the governments who want their special GOST protocols, etc, 
whoever.  In effect, you can be an incumbent if you have the capital to 
muscle in.

The good part of this is that IETF WG process forces open entry, so that 
at least we can see the muscle-bound in action.  The bad part is that it 
is still a battle of capital/resources, and it can settle into a 
stability of little forward action, as might be critiqued of TLS WG. 
Or, worse, it can slide into a behind-the-scenes capture into a 
full-scale cartel, as happened with CABForum.

Another difficulty is that barriers are as much a natural defence 
against bad ideas as well as new entrants (with good ideas?), which 
incumbents trumpet loudly.

> thought before we took that route.

The question or perspective may revert to, what is your mission?

If your mission is to preserve the security of the wider internet 
public, then reducing the power of the incumbents is an important 
element, because they will extract, and extraction typically means doing 
more of the same, but for them not for us (the net).

E.g., what Peter calls "PKI-me-harder."  Recent debates have surfaced 
the argument that a 'feature' we wish to preserve is hardware AES. 
Actually this is as much an incumbency plea, and is only end-user 
benefit if we can show more coverage.  It's pretty clear that Intel and 
other chip manufacturers will be most pleased if AES remains the sole 
MTI for the longest time, and if hardware is embedded in the infra.

OTOH, some people see the mission as serving the incumbents.  This has 
the merit that the incumbents pay the salaries of a lot of people who 
drive the committees.  Such groups as the IETF cannot function without 
large doses of time donated by owners of that time.  Large companies are 
needed to be able to employ enough people to provide the manpower to 
make the consensus system work, small companies can't handle the 
contribution, and lone wolfs aren't sufficient because there are too few 
of them.

The problem with the encumbency process should now be obvious -- after 
time it becomes security of own revenue -- of both the people in the 
groups and also the companies paying their salaries -- not security of 
the net.  Hence, (eg) AES in chips becomes a plaything for their revenue 
not our security.

There are no easy answers.

The notion of "serving the incumbents" has further merit if we assume 
that the world is full of naturally emerging bullies a.k.a. champions, 
and we need a way to at least limit their power.  E.g., the NSA is an 
obvious partner that we don't want, because they always drift into 
NOBUS-exploitability rather than joint security.  E.g., as was the case 
when IETF was formed, in a war against the telco-dominated OSI/ISO world.

It's not as if that industrial structure of the world has changed 
markedly, we all know who the big brands are.  Serving the incumbents 
should not be cast off lightly.

Out of all that: stricter rules or protocols in how we choose the suites 
could be *a really powerful way of neutering the competition*, and 
freeing up all that lost energy into better things.  (Of course, 
choosing that approach would have to be done adroitly otherwise we're 
setting ourselves up for a food fight.)

iang

---

From: Derek Atkins <[email-masked]>
Date: Wed, 15 Apr 2015 10:30:34 -0400

> thought before we took that route.

Then how do you differentiate the various potential proprietary ciphers?
Let's say that you need to support a dozen.  Do you need to include
additional OIDs in the handshake?  Or is there some other "proprietary
identifier" to allow differentiation of the proprietary ciphers?

> S.

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant