Subject: Re: [Cfrg] Requesting removal of CFRG co-chair

From: "Hilarie Orman" <[email-masked]>
Date: Sat, 21 Dec 2013 15:37:50 -0700

Is the CFRG co-chair the only person in the CFRG who has associations,
proclaimed or covert, with an organization intent on undermining the
standards process?  I seriously doubt it.  Then why trust anything
from any part of the IETF?  Because it is an open process with input
from a worldwide community.  That open process provides the resilience
against attack.

Take it as a challenge, is the IETF smarter than NSA or any other
organization with ulterior motives?  Can the IETF make sound technical
judgments based on written documents?  If you don't believe this is
possible, then by all means, start the purges.  Otherwise, step up to
the plate, be part of the evaluation-on-the-merits process, and choose
leaders based on their competence and not on their employment.

Hilarie

---

From: Tao Effect <[email-masked]>
Date: Sat, 21 Dec 2013 18:17:21 -0500

On Dec 21, 2013, at 5:37 PM, Hilarie Orman <[email-masked]> wrote:

> judgments based on written documents? 

Speaking for myself only, an organization's ability to make sound ethical choices impacts my ability to take it seriously.

What sort of people does the IETF/CFRG place in positions of authority?

Those types of decisions play a significant role in defining what an organization is, and what it does.

> and choose leaders based on their competence and not on their employment.

Should not the choice of an employer reflect on a person's competence?

Careful now, we're deadly close to reaching Godwin's Law. ;-P

- Greg

--
Please do not email me anything that you are not comfortable also sharing with the NSA.

On Dec 21, 2013, at 5:37 PM, Hilarie Orman <[email-masked]> wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg

---

From: Tao Effect <[email-masked]>
Date: Sat, 21 Dec 2013 18:29:31 -0500

> Should not the choice of an employer reflect on a person's competence?

Sorry, thinking a bit more about that question, I think the answer is "no, not necessarily, but maybe in some circumstances."

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sat, 21 Dec 2013 18:36:56 -0500

> leaders based on their competence and not on their employment.

It seems to me that Trevor's request is specifically raising concerns
about Kevin's competence in regards to the Dragonfly proposal.  He has
specifically cast doubt on Kevin's competence at communication within
the CFRG (point 1), his technical competence in the subject matter
(point 2), and his ability to effectively report beyond the group (point
3).  These are critical competencies for the co-chair of an IRTF
research group.

However, employment by and public affiliation with an antagonistic
organization are also relevant.

If Kevin was in a position within the NSA to know about their attempts
to subvert standards processes and did not alert the IRTF to this risk,
or was actively attempting such subversion himself, he needs to be
removed from his position as chair.  The chair has too much "wide
discretion in the conduct of Research Group business" [0] to be held by
an adversary.

OTOH, if he is a good-faith participant in the working group, but
discovered with the rest of us this year that his major institutional
affiliation was working behind his back to subvert the process in which
he was actively engaged, I would have expected him to acknowledge the
situation and at least make some sort of embarrassed remark about his
employer to the research group he co-chairs.  I've seen no such message
from Kevin to the CFRG list.  Kevin, maybe you can comment on this?

A good-faith Kevin who apologizes for his employer (or who even resigns
from the NSA in disgust at how his colleagues have undermined his work)
and continues as the co-chair of the CFRG is unfortunately
indistinguishable to the rest of us from a bad-faith Kevin who is intent
on continuing to subvert the privacy and security we want to build into
the Internet.  Kevin's future contributions to the group will inevitably
draw a higher degree of scrutiny and doubt from some parties because of
his affiliation with a known adversary.

At some point, a good-faith Kevin would realize that his position and
ability to lead as co-chair is damaged by the adversarial nature of his
employer to the goals of the research group.  Stepping down from that
position and continuing to contribute helpfully would be a way to
indicate where his allegiance lies in this conflict.  This is not a
purge.  No one is calling for his expulsion from the research group
entirely.

Regards,

	--dkg

[0] http://wiki.tools.ietf.org/html/rfc2014#section-5.3

---

From: Paul Lambert <[email-masked]>
Date: Sat, 21 Dec 2013 15:55:13 -0800

This debate started as a discussion of the ³Dragonfly² protocol.  The core
cryptographic mechanism has been reviewed in multiple forums for two years
and is incorporated into IEEE standards.  It is not an optimal mechanism,
but was constructed for it¹s IPR considerations to serve a specific
purpose.  It is useable and secure for the intended use cases and the
protocol should progress forward.  The discussions on the CFRG list for
time were productive and contributed to improvements in the protocol.

The CFRG co-chair¹s support of advancing the protocol has unfairly been
turned into a witch hunt.  The collateral damage is the stopping a
potentially useful protocol mechanism.

It is embarrassing to me to see the technical debate in the IETF lowered
to the point that we are removing and rejecting people by their
affiliation.  The whole point of standards is to bring into a room a group
of competitors and work through a process to create technical solutions in
a productive manner.  A continued debate on individuals open affiliations
is not productive.  We should not proceed with a witch hunt to remove
Government employees from the IETF.

Anyone with experience in standards activities should already be wary of
motives that drive each of the contributions.  I¹d rather have my
competitor (or in this case the NSA) in the room to get whatever reading I
can on their positions on our technical work.  We will always have to
second guess the motives of individuals bringing work into our open forums.

Paul

Paul A. Lambert

On 12/21/13, 3:29 PM, "Tao Effect" <[email-masked]> wrote:

>Sorry, thinking a bit more about that question, I think the answer is
>"no, not necessarily, but maybe in some circumstances."
>
>
>--
>> Speaking for myself only, an organization's ability to make sound
>>ethical choices impacts my ability to take it seriously.
>>

---

From: Tao Effect <[email-masked]>
Date: Sat, 21 Dec 2013 19:10:33 -0500

> Government employees from the IETF.

My position mirror's Daniel Gillmor's almost perfectly. That is to say, I am not in favor of "[removing] Government employees from the IETF".

I thought Daniel's last three paragraphs were poetry, especially the last one (emphasis mine):

The question is whether Kevin's affiliation has undermined his ability to represent and lead the recommendations made by the IETF.

I believe it has, and I am also hoping to hear from Kevin himself on this. In spite of my support for him stepping down as co-chair because of his affiliation, I don't want to give the impression that I am calling for his "removal" from the IETF, whatever that even means (anyone is free to send emails and recommendations to these lists).

For all I know Kevin is a swell guy who, as Daniel so eloquently put it:

he was actively engaged

Kind regards,
Greg

---

From: Watson Ladd <[email-masked]>
Date: Sat, 21 Dec 2013 16:38:45 -0800

> time were productive and contributed to improvements in the protocol.

Is Dragonfly secure? Not in the standard model: some hash functions break it.
There is no proof in the Random Oracle Model, and there were
significant questions
about its security relative to already deployed options. I still am
not sure what the impact of the possibility of
hunt and peck failing is on security: certainly not good. The IEEE has
its own history of cryptographic failures,
which as a member of the Wi-fi alliance you should certainly know
about. After all, you had a front row seat
for the most notable ones.

> potentially useful protocol mechanism.

The CFRG cochair does not have the ability to declare the result of a
last call that
never happened because he personally supports a proposal. The only reason this
irregularity was noticed is that Trevor Perrin and Rene Struik
subscribed to the TLS WG
as well. If the cochair cannot be trusted to properly represent the
result of a process, how
can we proceed?

The fact that this working group has specialist expertise that most
IETF participants don't
possess only increases the danger. I have seen participants on the TLS
WG fail to understand
what broke RC4, what MACs do, the security claims of AES-GCM etc, and
the resultant protocol
makes all kinds of stupid, unforced errors. (AES-GCM with random
nonces? Just one of many fun
surprises) I don't think the TLS WG is an outlier in this regard.

As a result WGs can consult with the CFRG on matters beyond their
bailiwick. In the case of Dragonfly the cochair's
statement was used as an argument for ending review of the protocol
because he said it was "adequate", even
as the CFRG membership had deep misgivings about it.

> Government employees from the IETF.

The purpose of the CFRG is not to create standards. It is to advance the usage
of cryptography and improve the security of the Internet. The abuses of process
committed by Kevin directly harm that goal by enabling a protocol to shortcut
the LC process in the CFRG, and thus avoid serious discussion.

> second guess the motives of individuals bringing work into our open forums.

Cryptography is not like networking: a bad choice in a networking
standard is merely an annoyance to
implementors or hurts performance/interoperability, and the protocols
are fairly transparent.
A subtly bad choice in a cryptographic standard can lead to
vulnerabilities over an extended period of time. The IETF track record
on this is abysmal, to the point where many of the best practical
cryptographers avoid working with the IETF.
The CFRG was formed so that for once the IETF would listen. By
conflating his personal views with the conclusion of the CFRG,
Kevin Igoe sends a clear message: the views of members of the CFRG are
irrelevant to the IETF process.

If we let him make the decisions, what is the point of the CFRG?

Sincerely,
Watson Ladd

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: Alyssa Rowan <[email-masked]>
Date: Sun, 22 Dec 2013 01:00:27 +0000

On 21/12/2013 22:37, Hilarie Orman wrote:

> Is the CFRG co-chair the only person in the CFRG who has 
> associations, proclaimed or covert, with an organization intent on 
> undermining the standards process?

Given you admit Kevin works for an organisation intent on undermining
the standards process, why would you, or anyone (or even he) wish him
to remain as co-chair?

Kindly explain.

> organization with ulterior motives?

Frankly: no. (Disquieting, I know.)

They are a billion-dollar-funded Nation State Adversary; this is a
mailing list.

We are at quite a profound disadvantage. Please be mindful of that.

> That open process provides the resilience against attack.

That open process is our only defense: but yes, it can be a powerful
one. And so, here we are, openly having this discussion.

When they're blatant, like Dual_EC_DRBG - or when they have an
@nsa.gov email address - we can spot it, if we actually take the time
to look.

But with something more subtle (mysterious 'seeds' with no
nothing-up-my-sleeve numbers, say), all bets are off. Without knowing
everything they know, really the best we can do is hope to spot which
bits look 'off'.

Based on what we've seen so far, they particularly seem to like:

• Subverting random number generators
• Specifying algorithms which need strong RNGs every time
• Standards which encourage implementations susceptible to timing and
  other side-channel attacks

We need to particularly watch out for those three. (Of course this
list isn't complete. I wish it were.)

I note the common thread: fragility. The results of their efforts are
often easy to implement poorly, very hard to implement well: who
implements slow constant-time Brier-Joye ladders for short Weierstrass
curves? [Raise your hands, please...] Who used deterministic nonces
with (EC)DSA? [...anyone *before* RFC6979?] That seems in line with a
paradigm of making things that could be secure, but usually aren't.

For future standards and primitives, if we can ensure that the right
way is more obvious, we can make our efforts more resilient, against
malice and mistake alike - hopefully.

> Can the IETF make sound technical judgments based on written 
> documents?

On technical cryptographic literature? That is the purpose of the
CFRG, surely.

They defer here, as Watson points out: so whomever represents the
opinions of here carries weight. For that weight of trust to fall on
untrustworthy shoulders is unsound.

> choose leaders based on their competence and not on their 
> employment.

The (reasonable) concern is that his employer deliberately wishes to
seed incompetence in crypto standards, so they can break them.

No 'purge' is necessary: you overstate. Having him on the group is not
an issue, as we are clearly well aware of his affiliations, and can
take his opinions with the trustworthiness and credibility that goes
along with them: as we should do with everyone, as you, Paul, and
Daniel quite correctly point out.

But as co-chair, in charge of stating - or, indeed, misstating! -
group consensus to others? Good grief, no. It seems untenable; more
importantly, untrustworthy. We cannot possibly do that with a straight
face after IETF 88, can we? Surely not. Surely, neither can he.

Kevin: Do you even have a comment on this? Anything? Any answer?

- -- 
/akr

---

From: "Dan Harkins" <[email-masked]>
Date: Sat, 21 Dec 2013 19:38:38 -0800 (PST)

On Sat, December 21, 2013 4:10 pm, Tao Effect wrote:
> The question is whether Kevin's affiliation has undermined his ability to
> represent and lead the recommendations made by the IETF.
>
> I believe it has.

  Proof by assertion

  I think some remedial IETF training may be in order. The chairman of
an IRTF task group (note the R) does not "represent and lead the
recommendations made by the IETF." The IETF makes it recommendations
based on rough consensus of the group, not through the imperial decrees
of individual chairmen (much less those of a _research_ task group). In
addition, we are all supposed to be treated as individuals here, not as
representatives of our employer or sponsor.

  You are engaging in a classic fallacy, argumentum ad hominem, and
it will create a dangerous precedent if it works.

  Dan.

---

From: Tao Effect <[email-masked]>
Date: Sat, 21 Dec 2013 22:57:14 -0500

>  Proof by assertion

This is not something that can be whittled down to a mathematical proof, so the word "proof" here is being misused.

This is word-of-mouth and the attitudes of individuals. If there can be proof, it can be found the volume of email related to the topic, both here, and in other locations where similar situations have occurred [1].

> The IETF makes it recommendations
> of individual chairmen (much less those of a _research_ task group)

From the emails that I've read in this thread, it seems like Kevin misrepresented the consensus of the group, and that was one of the reasons that was  cited in support of the proposal.

>  You are engaging in a classic fallacy

Point it out and I will take it back.

> argumentum ad hominem

Point it out and I will take it back.

I will readily pre-emptively apologize for any ad hominem committed on my part. I think I came close to making such remarks when I wondered aloud whether someone's choice of employer could reflected on their competence. I already apologized for the question, and in case it wasn't clear, I regret the comment, and I do take it back, because it was a silly thing to say.

Cheers,
Greg

[1] http://crypto.stackexchange.com/questions/10263/should-we-trust-the-nist-recommended-ecc-parameters

---

From: "Dan Harkins" <[email-masked]>
Date: Sun, 22 Dec 2013 00:22:33 -0800 (PST)

On Sat, December 21, 2013 4:38 pm, Watson Ladd wrote:
> never happened because he personally supports a proposal.

  Huh?

> the LC process in the CFRG, and thus avoid serious discussion.

  What process are you talking about? There was no LC declared and
certainly no process that required one before an answer could be
provided back to the TLS WG.

  You seem to have invented a process, declared Kevin Igoe in violation
of it, and concocted a conspiracy theory to explain it all.

  Dan.

---

From: Adam Back <[email-masked]>
Date: Sun, 22 Dec 2013 09:27:03 +0100

Sorry but no.  His employer has been exposed as spending $250m/year to
sabotage amongst other things standards.  Including paying RSA (with its
influence as defacto industry standards author (PKCS# series)) $10m to
include EC_DBRG as a random number generator.  And influencing NIST to
publish the same.  We do not know what other overt or soft-sabotage has been
going on where.  Note the disclosed information included mention of more
plausibly deniable soft-sabotage - eg architectural decisions pushing
towards less decentralization (concentrated tap points), fragility, and
'accidental' biases that leak keys (like the original DSA flaw that
Bleichenbacker found), and seeming organizational inability to deploy MUST
forward-secrecy ciphersuites throughout IETF protcools.  

Kevin is free to resign from his employment or not now he knows these facts. 
He surely must have some view on it whether he thinks its a good thing and
was actively working on it, or a bad thing, but unable to comment.

Regardless I do not think it remotely acceptable in the circumstances that
current NSA employees are in any position of administrative control within
any public standardization processes period.  Positions of administrative
control are weak points of public policy processes.  Often individuals have
insufficient energy to take on the administrative work-load, so they are
relatively easy to fill.  I have seen in the distant past UK MoD (presumably
GCHQ) people popping up in unlikely positions (eg national health medical
record security standards).

Cleary, and perhaps where your sympathies come from, this could be emotively
misread as a slight to Kevin personally.  Its not, its completely impartial. 
But its just a thats the risk you take when you work for government and
government is exposed to have committed outrageous, well funded and
persistent societal interest sabotage.  Society hardly needs to defend its
actions in reacting.  We are the egregiously wronged party.

How also should the US industry players feel, knowing how many $ billions
they are losing to european competitors as a result of this bad faith on the
part of NSA via NIST and abuse or collusion of commercial vendors.  Think
USG or NSA is going to write them a check to compensate?  They were all
used.

What do we have to do to finalize the process of removing?

Adam

---

From: Mike Simpson <[email-masked]>
Date: Sun, 22 Dec 2013 09:26:56 +0000

I¹d rather have my
> can on their positions on our technical work.

That sounds quite similar to playing poker. 

>  We will always have to

I don't think you have to second guess the motives of the NSA or any of its employees. If the co-chair wasn't comfortable with his employer deliberately undermining protocols recommended for  opsec then he could have got another job. 

Not seeing a major conflict of interest is worrying in itself. 

Mike

---

From: Watson Ladd <[email-masked]>
Date: Sun, 22 Dec 2013 09:28:51 -0800

>> never happened because he personally supports a proposal.

Kevin said to the TLS WG that the CFRG was fine with it. I don't know
exactly what was
said because it was off list, but the TLS WG understood that the CFRG
(and not just Kevin personally)
supported the protocol. This was wrong.

> provided back to the TLS WG.

Are you suggesting that the chairs of the CFRG have the power to decree
something acceptable by themselves, and speak for the CFRG? This is
a ridiculous claim. Whether last call or not, some process would be needed
to decide what the sense of the list was.

> of it, and concocted a conspiracy theory to explain it all.

I think it is reasonable for the chair to be forced to consult with
the membership before
deciding what the group's position will be, especially when the
conclusions of the CFRG will
be waved around to dismiss concerns about a protocol. Most people in
the IETF couldn't
tell you why the DDH isn't true in GF_{p}^{\times}, or what a pairing
is, or why PKCS 1.5 is worse
than OAEP. The point of the CFRG is that they won't have to: we'll do
the work for them. But that
only works if the CFRG properly represents its membership, and if
other WGs feel that the CFRG
is a useful resource. Do you think Kevin's continued presence as chair
is compatible with these goals?

---

From: "Dan Harkins" <[email-masked]>
Date: Sun, 22 Dec 2013 17:35:55 -0800 (PST)

On Sun, December 22, 2013 9:28 am, Watson Ladd wrote:
>>> The purpose of the CFRG is not to create standards. It is to advance
>>> the
>>> usage

  No, what I'm saying is that you're objecting to something that didn't
happen. There was no "shortcut" of a LC process (as you said). There was
no "result of a LC that never happened" (as you also said). There was no LC
made because there was no requirement to have a LC and the TLS WG did
not ask for such a thing.

> be waved around to dismiss concerns about a protocol.

  Your rhetorical flourish is a bit excessive. You act as though the
TLS WG requested that the imprimatur of the CFRG be placed upon
a protocol or that someone is behaving as if it did.

  As it says in the charter of the CFRG, "IETF working groups developing
protocols that include cryptographic elements are welcome to bring
questions concerning the protocols to the CFRG for advice." That's what
happened. They didn't say "please formally bless this protocol and
declare that it is secure and is the best possible solution to our problem".

  The TLS WG lacks the expertise to evaluate the underlying key
exchange and asked CFRG to see whether there was anything that
would make it unsuitable for a TLS cipher suite. That is all. There
were a few comments made about the protocol, and comments
were addressed, but there was nothing, and still remains nothing,
that makes it unsuitable for a TLS cipher suite.

> Most people in the IETF couldn't

  What I think is that you have misunderstood the process and have
misunderstood what happened and have leapt to the conclusion that
something nefarious happened and that it must be because the
co-chairman works for the NSA.

  Dan.

---

From: Alyssa Rowan <[email-masked]>
Date: Mon, 23 Dec 2013 07:10:39 +0000

On Mon 23 Dec 2013 01:35, Dan Harkins wrote:

> As it says in the charter of the CFRG, "IETF working groups 
> developing protocols that include cryptographic elements are 
> welcome to bring questions concerning the protocols to the CFRG
> for advice." That's what happened.

The TLS WG asked the CFRG for advice. They got Kevin's. He did not
mention the (unaddressed) concerns raised.

Documented fact: Kevin belongs to an agency with a "SIGINT Enabling
Project". Their job is to "enable" [backdoor and/or disrupt] strong
cryptography so the NSA can exploit it.

That makes his advice untrustworthy. For all we know, it's *literally*
his job to lie to us, and mislead us.

And if he is responsible, as co-chair, for relaying the CFRG's advice
to WGs, he is in the perfect position to do just that. The net effect
is to taint that advice with the NSA's proven untrustworthiness.

That's the central problem here.

The only fix is for him to step down as co-chair. (It wouldn't hurt
for him to resign from the NSA, or speak out, either; that he hasn't,
as Daniel raised, can only be reasonably interpreted as indicative of
his approval of the agency's actions.)

Do you agree?

If not, Dan, why do you wish Kevin to remain co-chair: despite the
profound concerns raised, and the fundamental conflict-of-interest
between his duties here, and the NSA's mission?

Kindly explain your reason. I'm keenly interested to hear it.

I mean, what I've heard from you so far is... just look at this gem:

On Thu 12 Dec 2013 16:06, on TLS WG, Trevor Perrin wrote:
>> The consequences of adopting a protocol we think is secure that 
>> isn't: dead people.

(Correct security engineering thinking, backed up by decades of proven
 history, and still just as true today, as Jacob Applebaum or Moxie
 would be able to confirm.)

On Fri 13 Dec 2013 08:35, on TLS WG, Dan Harkins wrote this reply:
> You obviously read too much fiction and have too little practical 
> experience. Dragonfly is not a threat to human life. Get a grip.

(...and well, I think that speaks for itself, doesn't it?)

- -- 
/akr

---

From: "Dan Harkins" <[email-masked]>
Date: Mon, 23 Dec 2013 00:44:14 -0800 (PST)

> his job to lie to us, and mislead us.

  "For all we know…", translation, "What I'm saying is complete
conjecture…."

> his approval of the agency's actions.)

  This is another example of the argumentum ad hominem fallacy.
You're saying that you will judge his statements based on some
aspect of him and not on their fundamental truth (or falsehood!).

> Kindly explain your reason. I'm keenly interested to hear it.

  No, I don't' agree. Because I:

  1. don't believe in guilt by association and have no truck with
      ad hominem attacks; and,
  2. think that a dangerous precedent would be set if a social media
      fueled campaign to influence an SDO was successful.

> (...and well, I think that speaks for itself, doesn't it?)

  Let's stick to the topic, shall we? There will be plenty of opportunity
in the future to extract sentences from my numerous posts to various
lists and to bring up irrelevance like death by protocol ("it's true, just
ask these people who have not been killed by a protocol!"). The topic
right now is the subject of this email.

  Dan.

---

From: Robert Ransom <[email-masked]>
Date: Mon, 23 Dec 2013 00:57:51 -0800

>>> The consequences of adopting a protocol we think is secure that

That statement was made by Watson Ladd (in
<http://www.ietf.org/mail-archive/web/cfrg/current/msg03549.html>),
not Trevor Perrin.

I note that none of the few people who are speaking in defense of
Kevin Igoe have even acknowledged the specific acts that Trevor Perrin
listed at the beginning of this thread, much less tried to refute the
charges or defend Mr. Igoe's acts.

Robert Ransom

---

From: Adam Back <[email-masked]>
Date: Mon, 23 Dec 2013 11:02:03 +0100

Dan perhaps this last round is overly focussing on details of how Alyssa
Rowan expressed the post.  Probably modulo the wording you agree at
principle leve, if I had to guess.  I'm more interested to see an
articulation of principle (from you and others).

As I said in my comments this is completely impartial.  It has nothing to do
with Kevin Igoe.  Its his employer the NSA, and the egregious, sustained
well funded, systemic full-spectrum APT attack on societal security. 
Society is the victim, NSA is the outed criminal organization.

Lets make an analogy: 

   Its like you had a massive electronic bank robbery where many ordinary
   people lost their retirement funds, never recovered, to the level of
   affecting US national budget and business reputation globally, and it was
   discovered that it was an insider job, one of the technical consultants
   slipped a backdoor into the security system.  For plea bargaining reasons
   he escaped prosecution (flipped a higher up player) but guilt is
   completely not in doubt.

   Ok now you have a standards body for open peer reviewed design of banking
   security sytems.  Do you invite this guy to chair the group?  Or one of
   his co-consipirators already is co-chair, do you remove him given his
   criminal association.  Lets say despite criminal record these people are
   exceedinly well qualified and clever, so there is real possibility with
   careful closed planning and bribes, hidden contracts etc that they might
   systematically succed in outwitting the public, or gaining some non-zero
   advantage in soft-sabotage/brittleness/disruption of robust architecture
   in plausibly deniable ways.

This is basically what happened.

But now the game is up, should we invite a new chair who was explicitly NSA? 
I think it would be a resounding NO.  

If we would not, why would we sit by inactive while an NSA employee is in
such a position for historical reasons.  What cold considered logical motive
could there be to defend him staying?

The public interest and security of society is much bigger than emotive
attachment to being nice to an individual.  An individual for whatever
reason who chose to align himself with NSA.  Sorry for him, but he made the
choice, informed or not, thats the luck of anyone who worked at NSA and now
faces the employment record implications.  And companies that were outed as
collaborating or taking or falling for bribes.  There are many victims of
this criminal organization, including their technical employees.

But the open standards process, the biggest victim, has the clear obligation
to clean house and avoid any association.  Even as participants everything
an NSA contributor says will be viewed with extreme caution and scepticism. 

To have an NSA personnel as the co-chair is clearly absolutely untennable in
this new reality.

Adam

ps Whether or not something untoward happened with Dragonfly isnt really the
principle, often there will be plausible deniability, soft-sabotage, unknown
collaborators, duped participants etc and there are specific allegations and
academic cryptanalysis as I see you are aware (and various papers).

http://arstechnica.com/security/2013/12/critics-nsa-agent-co-chairing-key-crypto-standards-body-should-be-removed/

But lets please put that detail to one side.  Its not personal to dragonfly
either, nor to you.

---

From: Tao Effect <[email-masked]>
Date: Mon, 23 Dec 2013 10:21:05 -0500

> charges or defend Mr. Igoe's acts.

Excellent observation! Instead of doing that, the response has been that a "witch hunt" is taking place, and that this is all based on "conspiracy".

And yet, neither of those claims is true.

Cheers,
Greg

---

From: Yoav Nir <[email-masked]>
Date: Mon, 23 Dec 2013 16:09:13 +0000

> And yet, neither of those claims is true.

It sure seems like it. More than one person on this list has stated that this is nothing personal, but an employee of the NSA (one of tens or hundreds of thousands) is automatically disqualified from chairing a working group.

The arguments against him are the kind that are leveled against IETF working group chairs on a regular basis - that they see consensus where consensus does not exist. Such arguments are easy to prove or disprove, because the mailing lists are public. I've seen plenty of arguments about whether the two people + author who liked the proposal vs the one person who asked a question and never replied to the list again constitute "consensus". None of those arguments resulted in a petition to remove the chair. I can only conclude that Kevin is getting special treatment because of his organizational affiliation, which IMO sets a very bad precedent. 

For the sake of argument, I will concede that all the accusations made are true: that (other than Dan) Kevin had the only message to the CFRG list with a favorable opinion of Dragonfly and that he presented that in a private message to the TLS chairs as "CFRG is fine with this algorithm". This could at worst be construed as mismanagement. Yet people present this as a malicious attempt by the USG to subvert the standards process so that people authenticate with a method that leaks timing information?  At the TLS layer or all places. That accusation is baseless and makes no sense for several reasons:
 - Nobody uses passwords at the TLS layer. A PAKE has been defined for years, and it's implemented in the most popular library. Nobody cares (sorry, Dan)
 - If the USG is spending money subverting the standards process to standardize a vulnerable password-in-TLS method, Americans should be worried - it's a monumental waste of their tax dollars.
 - The widespread surveillance that the Snowden documents revealed was all done with no cryptography. It was all done by gaining access to the plaintext or gaining access to keys. The agent trying to sabotage the standards process would not be a cryptographer with an @nsa.gov email. They'd be more surreptitious about it. (yeah, I know - that's what they'd like me to think)

I don't know Kevin personally, and have never exchanged a word or an email with him, but I believe that he is the target of a witch hunt.

Yoav

---

From: Natanael <[email-masked]>
Date: Mon, 23 Dec 2013 17:17:21 +0100

Considering that NSA is claimed to have paid the company RSA $10
million to put the backdoored RNG dual EC as default in BSAFE after it
was standardized (you probably all have heard of these news now),
which lots of companies use, are you *really* sure there are no issues
here that isn't obvious hidden here? Getting it approved in the TLS
standard could be just what they need to get it through the doors in
some place where those potential exploits that the protocol suffers
from (such as timing) are exactly what they need.

Can anybody here show with reasonable certainty that it's not going to
be a security risk anywhere?

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 23 Dec 2013 16:25:30 +0000

Folks,

What is not clear about [1]?

Since there are clearly people who are not up to speed
on the issues, I'll save you the trouble of a click:
[1] says explicitly that Dan's dragonfly-based draft is
not being progressed with the TLS WG. And that statement
from the TLS WG chairs pre-dates the start of this thread
by four days.

S.

[1] http://www.ietf.org/mail-archive/web/tls/current/msg10993.html

---

From: William Whyte <[email-masked]>
Date: Mon, 23 Dec 2013 13:05:15 -0500

Hi Yoav,

> It sure seems like it. More than one person on this list has stated that
this is nothing personal, but an employee of the NSA (one of tens or
hundreds of thousands) is automatically disqualified from chairing a
working group.

My position is that the NSA's mission includes subverting cryptographic
standards, and so it is inappropriate for an NSA employee to chair a
crypto working group in a standards body.

I don't have a problem with an NSA employee chairing a working group with
a different focus, and I don't have a problem with an NSA employee being
an individual contributor.

I don't have a position on Dragonfly and wasn't paying attention at the
time when Kevin is alleged to have made statements on behalf of CFRG. The
situation with Dragonfly matters to me only in so far as it has brought
attention to the fact that Kevin has a conflict between his employer's
mission and that of CFRG. Given this conflict, I think it is appropriate
for Kevin to resign or be removed. It is not clear that it is possible for
him to have the group's best interests at heart.

Cheers,

William

-----Original Message-----
From: Cfrg [mailto:[email-masked]] On Behalf Of Yoav Nir
Sent: Monday, December 23, 2013 11:09 AM
To: Tao Effect
Cc: [email-masked]
Subject: Re: [Cfrg] Requesting removal of CFRG co-chair

On Dec 23, 2013, at 5:21 PM, Tao Effect <[email-masked]>
 wrote:

>> Kevin Igoe have even acknowledged the specific acts that Trevor
>> Perrin listed at the beginning of this thread, much less tried to
>> refute the charges or defend Mr. Igoe's acts.
>
> Excellent observation! Instead of doing that, the response has been that
a "witch hunt" is taking place, and that this is all based on
"conspiracy".
> And yet, neither of those claims is true.

It sure seems like it. More than one person on this list has stated that
this is nothing personal, but an employee of the NSA (one of tens or
hundreds of thousands) is automatically disqualified from chairing a
working group.

The arguments against him are the kind that are leveled against IETF
working group chairs on a regular basis - that they see consensus where
consensus does not exist. Such arguments are easy to prove or disprove,
because the mailing lists are public. I've seen plenty of arguments about
whether the two people + author who liked the proposal vs the one person
who asked a question and never replied to the list again constitute
"consensus". None of those arguments resulted in a petition to remove the
chair. I can only conclude that Kevin is getting special treatment because
of his organizational affiliation, which IMO sets a very bad precedent.

For the sake of argument, I will concede that all the accusations made are
true: that (other than Dan) Kevin had the only message to the CFRG list
with a favorable opinion of Dragonfly and that he presented that in a
private message to the TLS chairs as "CFRG is fine with this algorithm".
This could at worst be construed as mismanagement. Yet people present this
as a malicious attempt by the USG to subvert the standards process so that
people authenticate with a method that leaks timing information?  At the
TLS layer or all places. That accusation is baseless and makes no sense
for several reasons:
 - Nobody uses passwords at the TLS layer. A PAKE has been defined for
years, and it's implemented in the most popular library. Nobody cares
(sorry, Dan)
 - If the USG is spending money subverting the standards process to
standardize a vulnerable password-in-TLS method, Americans should be
worried - it's a monumental waste of their tax dollars.
 - The widespread surveillance that the Snowden documents revealed was all
done with no cryptography. It was all done by gaining access to the
plaintext or gaining access to keys. The agent trying to sabotage the
standards process would not be a cryptographer with an @nsa.gov email.
They'd be more surreptitious about it. (yeah, I know - that's what they'd
like me to think)

I don't know Kevin personally, and have never exchanged a word or an email
with him, but I believe that he is the target of a witch hunt.

Yoav

---

From: Henrick Hellström <[email-masked]>
Date: Mon, 23 Dec 2013 19:47:11 +0100

I do not think it is /relevant/ to call this discussion a "witch hunt" 
(true or not).

Kevin Igoe is not on trial. The question should in my honest opinion be 
that of a plain cost-benefit analysis, and not that of his guilt or 
innocence.

Consequently:
- Has Kevin Igoe done a good job?
- Are there any better candidates for the position?
- Is this a completely exceptional case, or would replacing him as 
co-chair set an example that might hurt the reputation of the 
organization or its future processes in any way?

---

From: Alyssa Rowan <[email-masked]>
Date: Mon, 23 Dec 2013 18:49:26 +0000

>crypto working group in a standards body.
I agree, and feel that it is the core of the issue.

Those apparently arguing in favour of him remaining have seemingly avoided addressing this critical conflict of interest; the elephant in the room. Time for the elephant gun.

Fact: Kevin, the co-chair, works for the NSA. [@nsa.gov]

Fact: The NSA is known (and unanimously agreed) to be attacking the internet via mass surveillance among other means. [IETF 88 T/P]

Fact: As part of that attack, the NSA has a department (apparently 141 personnel strong, with a yearly quarter-of-a-billion US dollar budget) whose task is to subvert crypto standards and implementations. [Snowden, SIGINT Enabling Project budget]

Fact: We do not know what Kevin's tasks are at the NSA, or whether he is part of that department or not.

(My comment: We are unlikely to ever know for certain, without another Snowden: any NSA statement on this would I believe be hard for many to take at face value given their conduct thus far. If he knew of that department's existence, he chose to say nothing; if he did not previously know, it's pretty clear he couldn't fail to know by now, but strangely still has said nothing, despite a rather lively discussion calling for his resignation.)

So:

1. Should Kevin be removed from his co-chair position of this crypto advisory group?

2. If not, why do you think he should remain?

3. How would you expect this crypto advisory group to retain any credibility if it chose to retain an NSA employee as a co-chair, in light of everything now known?

I've made my position clear: he should step down. Please, state yours.
- --
/akr

---

From: John Viega <[email-masked]>
Date: Mon, 23 Dec 2013 13:51:30 -0500

It’s clear that, whatever happens to Mr. Igoe, we need to assume that we have untrusted— even malicious participants in the standards process.  It’s recently become clear that the NSA has no scruples on the matter, and I wouldn’t put it past other governments to attempt to subvert the standards process.

If Mr. Igoe is removed, it does not address the problem of how to design secure standards in the face of untrusted actors.  For instance, we can’t imagine that everyone trying to subvert the process will come to the table with ‘NSA’ as their affiliation— we should expect the NSA to work indirectly through other people to encourage standards they want to see adopted.

It doesn’t seem too relevant who the chair is— we should generally assume the chair is an untrusted entity, whether they are willingly attempting to subvert the system or not.

For instance, the other co-chair, David McGrew, is someone I personally trust.  He’s a terrific human being, but he and I both have our names on the GCM mode of operation.  In retrospect, I think there’s a definitely possibility that GCM became a standard so quickly not because of its applicability to high-speed hardware implementations and its lack of IPR restrictions (which is what I firmly believed at the time), but because the NSA had an easy time breaking the message authentication mechanism through side-channel attacks.  I’d say it’s absolutely possible that the NSA worked through us unknowingly to try to subvert the standards process.

In the specific case of GCM, a lot of great work has been done since in constant-time implementations that we think protects against side-channel attacks.  But I have no idea what the NSA’s true capabilities are— and I think that’s even true for many employees of the NSA, which is clearly very compartmentalized.

Until recent revelations, the conventional wisdom seemed to be shifting toward people believing that the NSA didn’t know much about cryptography that the rest of the world didn’t know.  We seemed to think that there were far more smart cryptographers in industry and academia than hidden away in the bowels of government agencies, and that our people probably were making bigger advancements than theirs.

Today, I think we all recognize that’s a dangerous assumption.  It’s important for us, as part of the standardization process, to assume we are living in a world where governments are trying to subvert us, and that their capabilities are far greater than we expect.  Along the lines of a mail Watson Ladd just sent to this list, I think the CFRG should be demanding a *well-vetted* proof of security in the standard model where possible, and a well-vetted proof in the random oracle model when not.

But, going beyond that, I think the CFRG should also require some evidence that any foreseeable side-channel attack is addressed, under the assumption of a large government as an adversary.

As for Mr. Igoe, I think there are a few separate issues here:

1) Does his job as chair put him in a better position to subvert the standardization process, or are there appropriate checks and balances?   This one is not clear cut to me, as a casual lurker.

2) Does the presence of an NSA employee in this particular leadership position undermine public trust in the standards body, whether he is in a special position to abuse that trust or not?  I think the answer to this one is probably YES.

3) Regardless of Mr. Igoe’s employment, has his behavior been inappropriate enough to be grounds for termination?  Here, I think the initial concerns that Trevor Perrin raised about Kevin himself can possibly be chalked up to mistakes that should deserve a second chance.  HOWEVER, I feel that his utter lack of engagement in the discussion is a huge issue.

I believe public perception is important to the effectiveness of the efforts here, and I think Mr. Igoe’s lack of interest in engaging is not acceptable from someone in a leadership position.  I have less of a problem with the strong possibility that he’s a malicious player— the presence of such players is just a fact that the CFRG and the IETF have to be resilient enough to work around.

John

---

From: Tao Effect <[email-masked]>
Date: Mon, 23 Dec 2013 19:16:43 -0500

John,

Nice email. If I may, I'd like to reiterate and highlight some of the points you made that I thought were most salient:

1. Remember that the most subversive, damaging, and dangerous sabotage will come from someone nobody suspects (possibly by definition).

2. That Kevin's reputation (via himself for staying mum this whole time, and his employer), "undermine[s] public trust in the standards body".

Regarding that point: this seems like a good thing if the standards body ends up making lackluster/sabotaged recommendations.

3. It is day four now, and still no response or engagement from Kevin.

Given #3, I decided to do a quick google search for "Kevin Igoe". I couldn't find anything on him (at least none of the results seemed relevant).

Let me preface the following by saying that I'd never heard of Kevin before I saw Trevor's proposal cross my news feed, but it seems to me that with so much public scrutiny on one person, you'd think that person would feel pressured into making some sort of statement in defense of themselves.

Since this has not happened (yet), and Google couldn't answer my questions, I'll awkwardly ask this list: is Kevin Igoe a real person? Like, is that his real name? Where is the evidence?

Thanks,
Greg

---

From: Tao Effect <[email-masked]>
Date: Mon, 23 Dec 2013 19:53:41 -0500

Replying to myself:

> Since this has not happened (yet), and Google couldn't answer my questions, I'll awkwardly ask this list: is Kevin Igoe a real person? Like, is that his real name? Where is the evidence?

I did some more searching, and am still quite puzzled:

- Kevin is introduced as co-chair with primary credentials as having "led the design of the SHA-1 hash algorithm."
- The wiki page on SHA1 doesn't have his name
- The first reference on the wiki [1] does not have his name
- Googling "Kevin Igoe NIST" resulted in other documents, but no significant info on who Kevin actually is could be found.

Earliest reference to "Kevin Igoe NSA" is a single document that claims to be from 1996, where his name appears once in the acknowledgments. [2]

Next earliest (that I could find) is from 2009, where he again, is only listed in the acknowledgements. [3]

Seems like a pretty shoddy basis to make an employee of the NSA co-chair of the CFRG. [4] At this point I'm still wondering whether this is a real name. Seems like it was inserted over the years to a bunch of acknowledgement sections, and that's it.

Cheers
Greg

[1] http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
[2] https://groups.csail.mit.edu/mac/classes/6.805/articles/money/nsamint/nsamint.htm
[3] http://tools.ietf.org/html/rfc5656
[4] bs

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 24 Dec 2013 01:59:44 +0000

On 12/24/2013 12:53 AM, Tao Effect wrote:
> is Kevin Igoe a real person?

Oh FFS. Please cut the crap. That level of non-debate is just
appalling.

Let me suggest you all (especially the obvious set of folks
who've just recently started posting to this list for just
this topic) take a rest with the infantile gibberish at least
until after the holidays.

For those who are concerned about the pervasive monitoring
at which the US and UK have been caught red-handed, this kind
of silliness just undermines real progress. Please try to
think about what is likely to be long-term effective before
spouting stuff like the above.

S.

---

From: Richard Barnes <[email-masked]>
Date: Mon, 23 Dec 2013 21:05:35 -0500

Kevin is a regular IETF attendee, and an author of several RFCs.

http://tools.ietf.org/googleresults?cx=011177064926444307064%3Arsqif7nmmi0&q=Igoe&sa=Search&cof=FORID%3A9&siteurl=tools.ietf.org%2Fhtml%2F&ref=&ss=3369j2532811j6

He is most definitely a real person.

--Richard

On Monday, December 23, 2013, Tao Effect wrote:

> Replying to myself:
>
> On Dec 23, 2013, at 7:16 PM, Tao Effect <[email-masked]<javascript:;>>
> wrote:
> > Given #3, I decided to do a quick google search for "Kevin Igoe". I
> couldn't find anything on him (at least none of the results seemed
> relevant).
> >
> > Let me preface the following by saying that I'd never heard of Kevin
> before I saw Trevor's proposal cross my news feed, but it seems to me that
> with so much public scrutiny on one person, you'd think that person would
> feel pressured into making some sort of statement in defense of themselves.
> >
> > Since this has not happened (yet), and Google couldn't answer my
> questions, I'll awkwardly ask this list: is Kevin Igoe a real person? Like,
> is that his real name? Where is the evidence?
>
> - Googling "Kevin Igoe NIST" resulted in other documents, but no
> significant info on who Kevin actually is could be found.
>
> Earliest reference to "Kevin Igoe NSA" is a single document that claims to
> be from 1996, where his name appears once in the acknowledgments. [2]
>
> Seems like a pretty shoddy basis to make an employee of the NSA co-chair
> of the CFRG. [4] At this point I'm still wondering whether this is a real
> name. Seems like it was inserted over the years to a bunch of
> acknowledgement sections, and that's it.
>
> Cheers
> Greg
>
> [2]
> https://groups.csail.mit.edu/mac/classes/6.805/articles/money/nsamint/nsamint.htm

---

From: John Bradley <[email-masked]>
Date: Mon, 23 Dec 2013 23:10:16 -0300

The curent level of debate has not been worth commenting on, but I have to +1 Stephen's comment.

John B.
(Perhaps not a real person as well, the verdict is still out:)

On Dec 23, 2013, at 10:59 PM, Stephen Farrell <[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (GNU/Linux)
> 
> iQEcBAEBAgAGBQJSuOqQAAoJEC88hzaAX42iZ6EH/RDWyPAVucG8DLuv88U/cObn
> PdhirCJWNubEDD+pDbw9XNxFPeAc6m0y9c+2qyUo66fxkI9N3qQm0TP4DsNABHCG
> HufPGHVd8ioNBPtMRsPdwnYd2QbTsZnCoQWsNIT6jF3t1Cq6Znh1lJtg1jyIeaMO
> C56wClXv/MCxrW+tKRtNF223KUy/PJS+kxIEcNJjC6Mq/AhFGpWat7wwM8hr8CUq
> BdLOIqhE1BtDc6gGNeOXBUdPCh4s6gMgnFF4Meth3pbSBto7LHCF2f+KPGyuAibU
> +j3tcwkMzbKmy4K07ucBLrKJefzYrdYUqoqDnZgj3IJu6/hXfSDowsThZ63zfm8=
> =c9oT
> -----END PGP SIGNATURE-----

---

From: Tao Effect <[email-masked]>
Date: Mon, 23 Dec 2013 21:15:45 -0500

> Kevin is a regular IETF attendee, and an author of several RFCs.  

I never questioned that his name appears on several RFCs.

I even linked to such an RFC. :-)

It's just starting to become rather obvious that whoever is carrying this name around, probably considers it to either be an alias.

And even if that's not the case, it seems rather strange that someone who is serving as co-chair of an organization that makes recommendations to the world about the cryptography that it uses, appears to be rather difficult to hold accountable for the accusations that have been levied against him by multiple people in this thread.

So, the members of the CFRG might not be real people and don't seem to have any accountability? Is this the moral of the story?

It's also interesting to see some of the replies to my innocent questions.

Here's one from Stephen Farrell, it can be summarized entirely like so: "Oh FFS. Please cut the crap."

Here's one from John Bradley: "+1 Stephen's comment"

Some substance, gentlemen, please? This is not Facebook. It's easy to disturb the air with exclamations, but it's not a nice thing to do when your empty replies land hundreds? of inboxes.

Cheers,
Greg

---

From: Tao Effect <[email-masked]>
Date: Mon, 23 Dec 2013 21:20:19 -0500

> I even linked to such an RFC. :-)

Correction: I linked to an RFC where he was acknowledged, not listed as an author.

My understanding though is that being listed as an author on an RFC is not proof that an identity is real. If I'm mistaken about this, feel free to correct me.

Cheers,
Greg

---

From: Richard Barnes <[email-masked]>
Date: Mon, 23 Dec 2013 21:29:42 -0500

On Mon, Dec 23, 2013 at 9:15 PM, Tao Effect <[email-masked]> wrote:

> It's just starting to become rather obvious that whoever is carrying this
> name around, probably considers it to either be an alias.
>
> And even if that's not the case, it seems rather strange that someone who
> is serving as co-chair of an organization that makes recommendations to the
> world about the cryptography that it uses, appears to be rather difficult
> to hold accountable for the accusations that have been levied against him
> by multiple people in this thread.
>
> So, the members of the CFRG might not be real people and don't seem to
> have any accountability? Is this the moral of the story?
>

No, the moral of the story is that those of us who have been active in CFRG
and the IETF groups that depend on it are well aware that Kevin is a real
person.  He comes to IETF meetings and wears a bowtie and a badge that says
"NSA".  There has never been anything hidden about his name or his
affiliation or the reality of his existence.

That said, the IETF and IRTF purposely don't have a "papers please" policy
-- we allow people to use email addresses with pseudonyms like "Tao
Effect".  That's part of the openness of our process.

> Some substance, gentlemen, please? This is not Facebook. It's easy to
> disturb the air with exclamations, but it's not a nice thing to do when
> your empty replies land hundreds? of inboxes.
>

The reason for these reactions is that accusing someone of not existing
does not contribute to this debate in a meaningful way.

--Richard

On Mon, Dec 23, 2013 at 9:15 PM, Tao Effect <[email-masked]> wrote:

> It's just starting to become rather obvious that whoever is carrying this
> name around, probably considers it to either be an alias.
>
> And even if that's not the case, it seems rather strange that someone who
> is serving as co-chair of an organization that makes recommendations to the
> world about the cryptography that it uses, appears to be rather difficult
> to hold accountable for the accusations that have been levied against him
> by multiple people in this thread.
>
> So, the members of the CFRG might not be real people and don't seem to
> have any accountability? Is this the moral of the story?
>
> Some substance, gentlemen, please? This is not Facebook. It's easy to
> disturb the air with exclamations, but it's not a nice thing to do when
> your empty replies land hundreds? of inboxes.
>
> Cheers,
> Greg
>
> --

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 24 Dec 2013 02:35:49 +0000

On 12/24/2013 02:15 AM, Tao Effect wrote:
> Some substance, gentlemen, please?

So I'm willing to bet that you don't know that the entire IAB
met with Kevin to review the CFRG in Vancouver, as is commonly
done with one IRTF RG each IETF meeting. Its quite reasonable
that level of detail is not common knowledge but it is not
reasonable for what might be a substantive discussion about
how CFRG ought deal with snowdonia to be turned into a
kindergarten side-show based on apparently total ignorance as
to how the IRTF and IETF actually do business.

If you (and others who've very recently turned up on this list)
actually care about pervasive monitoring, you should desist
from this kind of nonsense and think more about how to mitigate
the problem.  Or at the very least, ask questions about how things
are, and don't start off by making stupid insinuations. The
entire discussion calling for Kevin to stand down or be removed
is IMO just a distraction from what ought be a real debate on
this list.

That real debate would consider how to more quickly spot that
the ECC DBRG reports were worth serious consideration, how to
deal with nothing-up-my-sleeve parameters, and how to deal with
a future where NIST are no longer the gold-standard for vendors
of important systems and we'll need to have some way to deal
with the likes of 25519. And perhaps whether the status-quo
dividing line between CFRG and the IETF is correctly drawn
at ciphers and modes of operation.

The guilt-by-association drama that we've been seeing is
entirely getting in the way of that much more important debate.

S.

PS: Yes, my language above is immoderate. Frankly, I am quite
pissed off that this side-show is distracting from more real
progress on mitigating pervasive monitoring.

---

From: Tao Effect <[email-masked]>
Date: Mon, 23 Dec 2013 21:39:41 -0500

On Dec 23, 2013, at 9:29 PM, Richard Barnes <[email-masked]> wrote:

> No, the moral of the story is that those of us who have been active in CFRG and the IETF groups that depend on it are well aware that Kevin is a real person.  He comes to IETF meetings and wears a bowtie and a badge that says "NSA".  There has never been anything hidden about his name or his affiliation or the reality of his existence.
> 
> That said, the IETF and IRTF purposely don't have a "papers please" policy -- we allow people to use email addresses with pseudonyms like "Tao Effect".  That's part of the openness of our process.  

To call this openness is laughable.

You can Google my name and see that I am easily held accountable for anything that I say or do.

It is not "openness" when an unknown man with "a badge that says 'NSA'" is made the co-chair of an international organization that makes recommendations for protecting people's data.

Here's what openness in an organization like this should look like:

- You Google the co-chair's name and you instantly find his face smiling back at you on the first page.
- When he's first introduced as the man who "led the design of the SHA-1 hash algorithm", you can verify that this claim is in fact true.
- He's got some kind of positive public reputation built up and something to lose so that we know that if he decides to backstab the public he can be held accountable.

What's taking place here is a joke.

- Greg

---

From: Tao Effect <[email-masked]>
Date: Mon, 23 Dec 2013 21:48:49 -0500

On Dec 23, 2013, at 9:35 PM, Stephen Farrell <[email-masked]> wrote:

> done with one IRTF RG each IETF meeting.

It seems like you're not understanding the point that I'm making.

It *doesn't matter* if you met someone who calls themselves Kevin at some meeting.

Or if you see that someone named Kevin has an RFC to their name.

That (1) doesn't prove that you're not talking to someone with an alias, and (2) is not sufficient accountability for a co-chair of an organization like this (IMO).

> the problem. 

I agree. Do you mean something like this:

http://okturtles.com/other/dnsnmc_okturtles_overview.pdf  ?

I sent that proposal to multiple IETF mailing lists over a week ago. You can have a look at the discussions that have taken place so far about it here:

http://okturtles.com/#reviews

- Greg

---

From: John Viega <[email-masked]>
Date: Mon, 23 Dec 2013 21:49:24 -0500

Whether Mr. Igoe is using an alias or is a composite is, I think, irrelevant to anything other than his credentials for getting the job in the first place (and, I’m quite sure he’s real).

I think it’s reasonable to hold the opinion that this discussion is silly and overhyped.  I think there’s a good chance that Mr. Igoe had no subversive intent whatsoever.  I also don’t see how an IRTF working group chair can, with high probability, subvert the process (though that doesn’t mean it isn’t possible).  

However, I would ask people who are annoyed by the discussion to realize that public perception is important.  The fact that people are coming out of the woodwork to comment just emphasizes that many people perceive this as an issue (though I don’t consider myself coming as out of the woodwork— I’ve been lurking for years, and have definitely posted a few times in the past).

To me, the most important thing the group can do is address how it makes sure to protect from subversive actors.  If we had a clear answer there, then I think it matters far less who the chair is, because we can give outside eyes a better comfort level.  I don’t think it’s productive to be dismissive of the concern, even if you do not agree.

John

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 24 Dec 2013 03:12:25 +0000

On 12/24/2013 02:49 AM, John Viega wrote:
> Whether Mr. Igoe is using an alias or is a composite is, I think,
> irrelevant to anything other than his credentials for getting the job
> in the first place (and, I’m quite sure he’s real).
> 
> I think it’s reasonable to hold the opinion that this discussion is
> silly and overhyped.  I think there’s a good chance that Mr. Igoe had
> no subversive intent whatsoever.  I also don’t see how an IRTF
> working group chair 

Research group chair. Sorry to be pedantic, but we need to start
out at least understanding that the IRTF cannot produce an IETF
standard.

> can, with high probability, subvert the process
> (though that doesn’t mean it isn’t possible).
> 
> However, I would ask people who are annoyed by the discussion to
> realize that public perception is important.  

I do. (But am annoyed.) I think that laziness in those who are
opposed to pervasive monitoring is as damaging as laziness in
those who think their local governments can do no wrong.

There is serious laziness in this thread so far, by which I
mean the assumption that guilt-by-association is not hugely
damaging once accepted and the level of ignorance of what is
the actual situation.

> The fact that people
> are coming out of the woodwork to comment just emphasizes that many
> people perceive this as an issue (though I don’t consider myself
> coming as out of the woodwork— I’ve been lurking for years, and have
> definitely posted a few times in the past).

I accept that people find it jarring that someone who works for
an organisation spending US$250M/yr undermining Internet security
can be an ok co-chair. However, David works for a large multinational
as do many many RG and WG chairs. I get funded by an en EU FP7
project and have in the past worked for large companies that did
get money from UK MoD and other similar customers. If you actually
think it through, then the pure who-chairs question reduces to
only being a matter of perception iff we have the level of
transparency we have. And I hope we (the IETF and IRTF) maintain
what is much more a core principle which is to not be driven by
irrational perception but to pay most attention to engineering and
science. (Whilst not being "pure" in any respect:-)

The reason the who-chairs thing reduces to perception is that
if that is not true, then our processes can be far more easily
undermined by anyone who has an axe to grind. And almost all
participants in standardisation do have some axe to grind. (I
think someone else pointed that out before as well.)

The main effect of chairs is that they either move the discussion
along well, or badly, or not at all. The only situations where a
chair can really dominate are ones where nobody really cares about
the outcome anyway. And there are (in the IETF) appeal processes
in case someone thinks stuff has gone wrong. The IRTF differs in
that respect since the IRTF doesn't do standards.

> 
> To me, the most important thing the group can do is address how it
> makes sure to protect from subversive actors.  

I disagree, on the basis that I think we (IETF) have done that
for decades. More recently for IRTF, but it inherits a lot of
good IETF processes.

For me, figuring out how to mitigate pervasive monitoring is
far more important.

> If we had a clear
> answer there, then I think it matters far less who the chair is,
> because we can give outside eyes a better comfort level.  I don’t
> think it’s productive to be dismissive of the concern, even if you do
> not agree.

It is fair to dismiss concerns where those appear to be based
on an impressive level of ignorance of how things actually work.
Those with such concerns should ask questions, and those would
be welcome, but baseless suppositions e.g. that some real people
are invented are just plain dumb.

S.

PS: I am not saying that all the how-stuff-works is very obvious
and ought be known, but I am saying that those who don't know,
should start by finding out before casting aspersions.

>> It's just starting to become rather obvious that whoever is
>> carrying this name around, probably considers it to either be an
>> alias.
>> 
>> And even if that's not the case, it seems rather strange that
>> someone who is serving as co-chair of an organization that makes
>> recommendations to the world about the cryptography that it uses,
>> appears to be rather difficult to hold accountable for the
>> accusations that have been levied against him by multiple people in
>> this thread.
>> 
>> So, the members of the CFRG might not be real people and don't seem
>> to have any accountability? Is this the moral of the story?
>> 
>> Some substance, gentlemen, please? This is not Facebook. It's easy
>> to disturb the air with exclamations, but it's not a nice thing to
>> do when your empty replies land hundreds? of inboxes.
>> 
>> Cheers, Greg
>> 
>> -- Please do not email me anything that you are not comfortable
>> also sharing with the NSA.
>> 
>>> 
>>> 
>>> --Richard
>> 
>> _______________________________________________ Cfrg mailing list 
>> [email-masked] http://www.irtf.org/mailman/listinfo/cfrg
> 
> 
> 
> 
> _______________________________________________ Cfrg mailing list 
> [email-masked] http://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Tao Effect <[email-masked]>
Date: Mon, 23 Dec 2013 22:29:51 -0500

Just to be clear: I *do not care* if "Kevin" is an alias.

That, on its own, does not matter to me at all.

What matters to me is:

1. Whether the recommendations made by the CFRG are good.

That's it.

Because I do not spend my time analyzing the mathematical details of cryptography, but rather defer that to folks who specialize specifically in that and whom I trust to do a good job of it, I, and 99.999% of the people in the same boat on this planet, need to know:

1. Are the people making these recommendations honest?
2. Are the people making these recommendations transparent?
3. Are they trustworthy?
4. Do they have the best interests of those using their recommendations at heart?
5. Do they know what they're talking about?

If the answer is "No" to any of those questions, then this organization has failed its stated purpose, which is:

The CFRG serves as a bridge between theory and practice, bringing new cryptographic techniques to the Internet community and promoting an understanding of the use and applicability of these mechanisms via Informational RFCs (in the tradition of, e.g., RFC 1321 (MD5) and RFC 2104 (HMAC). Our goal is to provide a forum for discussing and analyzing general cryptographic aspects of security protocols, and to offer guidance on the use of emerging mechanisms and new uses of existing mechanisms. IETF working groups developing protocols that include cryptographic elements are welcome to bring questions concerning the protocols to the CFRG for advice.

— http://irtf.org/cfrg

Had Kevin been introduced as: "Hi, I'm Kevin from the NSA. BTW, my employer wants to subvert everything your organization does. And, also, that's not my real name."

Well, then I don't think we'd be having this discussion, and there'd be no problem.

Cheers,
Greg

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 24 Dec 2013 03:41:11 +0000

> 1. Whether the recommendations made by the CFRG are good.

Then question those, as appropriate.

AFAICS, there was discussion of dragonfly and Kevin reported
fairly on that. I can buy a criticism that too much of that
discussion was at f2f meetings and not on list, but honestly,
as Yoav said, and as demonstrated by the TLS WG chairs
conclusion - nobody really cares about dragonfly except Dan,
and those opposing dragonfly. (Incidentally Dan has done
loads of fabulous work in the IETF that I do know about.
I can buy arguments that's he's right on wrong on this one,
but arguments that he's some kind of bad person are just
nonsense.)

If you find the dragonfly thing problematic, then you will
presumably find the fact that Kevin also reported to the TLS
WG that chacha20 was fine equally problematic. From my pov
that was subject to only a little more CFRG discussion, even
though its far more significant. And in that case the CFRG
conclusion that Kevin again correctly reported is one that
takes us outside the NIST suite-B box. (Luckily, the salsa/chcaha
thing has been well-debated in the academic crypto community
so there was far less angst than in the dragonfly discussion.)

If you or someone else were not a part of those discussions
then your first duty is to review the list archive and not
to make assumptions as to what might have happened.

S.

---

From: John Viega <[email-masked]>
Date: Mon, 23 Dec 2013 22:52:20 -0500

On Mon, Dec 23, 2013 at 10:12 PM, Stephen Farrell <[email-masked]> wrote:

Actually, I do appreciate the difference, and given the nature of the discussion, I'm sorry I was sloppy on this.

I don't disagree with any of the above.  Anyone who has done serious standards work knows that each company's perceptions of what is "best for the public" is generally tainted through the lens of what is best for that company (and hopefully its customers).  There are many bad actors in the standardization process.

Well, I agree that is also very important.  But let me clarify-- I think the IETF/IRTF does a fairly good job of addressing subversive actors.  But that doesn't mean it couldn't do better.

I don't think that it's reasonable to expect the public to understand the processes of standards bodies.  But we should still be able to give them a concise overview that easily conveys why the public should trust us.  I think one way to address the problem in part, as I previously recommended, is to only make recommendations when there is an appropriate proof of security and additional analysis on side channel attacks.

---

From: Watson Ladd <[email-masked]>
Date: Mon, 23 Dec 2013 23:40:13 -0500

> science. (Whilst not being "pure" in any respect:-)

There is a great email from Phil Rogaway to the TLS WG circa 1995
begging them to use ETM.
They don't. The result is BEAST and Lucky13. How exactly is this
paying attention to science?

At IETF 88 the TLS WG didn't endorse a single solution to attacks
currently viable against TLS 1.2 They couldn't even
publish a "don't use RC4" document. The Best Current Practices
document addressing this issue is languishing in
a working group made specifically for this document, with no activity
since September.
The draft author has no clue why.
Is it seriously too much to ask you to put some pressure on UTA and
TLS to get these things fixed ASAP?

Currently the only ID with a shepherd is draft-mcgrew-tls-aes-ccm-ecc.
Apparently, introducing another secure ciphersuite for
specialized applications (in this case embedded) is more important
than disabling an insecure cipher used by 33% of all TLS servers
according to the most recent numbers.

> think someone else pointed that out before as well.)

Some axes are better to grind than others. Heck, I'll be chair of
CFRG. We'll hold a straw vote
on the lines of my email on what kind of proofs are to be demanded
from those who want us to
bless a protocol first thing, and I will personally put $100 bond on
any protocol we approve being broken,
provided the protocol is standardized exactly as we say.

> that respect since the IRTF doesn't do standards.

How do I appeal against the continued failure of the TLS WG to fix the
problems rediscovered
this year? I know, I'll email the security area head telling them this
is a problem.

> For me, figuring out how to mitigate pervasive monitoring is

Is this something that TLS doesn't solve? If it is too hard/expensive
to deploy, that's yet another
black mark against the history of the TLS WG. (Okay, UDP, but DNSCurve)

> are invented are just plain dumb.

If I look at the TLS WG I see 20 years of a broken, overly complex,
protocol, with no effort being made to fix it.
Whatever process was producing that result needs to be fixed. I agree
imaginary people are an idiotic suggestion: the
real record (pre-Dragonfly, pre-Snowden) shows that changes have to be
made to the CFRG, the TLS WG, and probably to the way that the broader
IETF views and understands cryptography.

> should start by finding out before casting aspersions.

I'll start asking some questions: How many broken protocols does the TLS WG
get to propose and have implemented as standards before it becomes
a requirement for them to get some independent analysis of whatever
they propose?

How do you plan to deal with the failure of UTA to advance a necessary
Best Practices document through the process in a timely
manner?

How do you propose to ensure that other working groups in the security
area are not making similar misjudgements?

Does the IETF have any process to fix or address these issues?

Do you believe the CFRG has been effective in addressing the need for
guidance on cryptography in the IETF?

Do you have any ways to improve that guidance or the process leading to it?

Is there any evidence the IETF can develop cryptographic protocols vs.
having outside groups do it and present the standard to IETF?

Sincerely,
Watson Ladd

---

From: David McGrew <[email-masked]>
Date: Tue, 24 Dec 2013 00:25:58 -0500

> Since this has not happened (yet), and Google couldn't answer my questions, I'll awkwardly ask this list: is Kevin Igoe a real person? Like, is that his real name? Where is the evidence?

Greg,

please understand that, to the people who have attended CFRG and IETF 
meetings with Kevin, it does sound a bit silly to suggest that he is not 
a real person.   I am not sure why he has not responded on the list, 
though it is the holiday season in the U.S., which could be the reason.

David

---

From: David McGrew <[email-masked]>
Date: Tue, 24 Dec 2013 00:32:46 -0500

Thanks Stephen for introducing these important points into the conversation:

> at ciphers and modes of operation.

People interested in helping progress on these topics could offer review 
or suggested contributions on the following internet drafts:

- draft-mcgrew-standby-cipher-00

- draft-irtf-cfrg-cipher-catalog-01

These drafts do not cover the entire set of issues., of course. 
Technical proposals that improve the state of cryptography on the 
Internet are always welcome at CFRG.   It would be good to have more 
discussion on these points.   I would also add resistance to side 
channel attacks and resistance against IV or nonce misuse as important 
topics.

David

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 24 Dec 2013 15:08:41 +0000

Hiya,

> paying attention to science?

Opinions about EtM were different in 1995 as I recall.
I'm not myself sure that an EtM variant of TLS would not
have had similar instances of problems - the evolution of
attacks on TLS has been interesting and I hope we've all
learned a lot of lessons from what is really the first time
we've scaled out deployment of a security protocol to that
extent.

> The draft author has no clue why.

The above is inaccurate. Yaron wanted their draft in UTA. And
languishing since September is laughable. Even the TLS renego
bug RFC took 4 months, and that was much more of a deal than
Yaron's draft. (Yaron's and the other work to be done in UTA
are very important, but don't rise to that level.)

> TLS to get these things fixed ASAP?

You misunderstand how the IETF works. I can't tell anyone what
to do and expect it to happen. (Luckily, because I'm wrong about
stuff just as often as others;-)

The UTA WG was formed within about a month of IETF-88. That is
lightening fast for this-decade's IETF. (We might bemoan that,
but that's where we are.) That speed was partly as a result of
encouragement from me and other members of the IESG, but the
real impetus comes from the community, not the leadership.

I think that there are fair criticisms to be made about the rate
of progress in TLS, and those have been made on that list and
Sean (the responsible AD) and the chairs are working to improve
matters. I'm confident they will.

But to understand that, you need to take into account things
like the deployment rate for TLS 1.2 and the factors that impacted
on that. Most of those are not under the control of the TLS WG,
never mind its chairs. (Again, the IETF and IRTF are volunteer
organisations - demands for action don't make sense there.)
But in any case, that's a topic for the TLS list and not here.

> according to the most recent numbers.

Sarcasm? Will that help?

> provided the protocol is standardized exactly as we say.

Honestly, I think taking up David's challenge to write the
draft(s) he mentioned would be a better way for someone new
to the RG to help out.

Your offering to chair seems meaningless to be honest.

> this year? I know, I'll email the security area head telling them this

More sarcasm. And combined with ignorance as to how the IETF works.
Sigh.

As I said above IETF area directors don't get to tell people what to
do. Participants are volunteers. For TLS, take your concerns to the
TLS list.

> black mark against the history of the TLS WG. (Okay, UDP, but DNSCurve)

I've no idea what you mean. But we can probably pass on.

> protocol, with no effort being made to fix it.

No effort is nonsense. I think you mean you disagree with some
of what has been done and would like it all to be done faster.
Other than the blatant overstatement which doesn't help at all,
there are a lot of people who'd share that opinion. Making the
statement as you've done is however, counterproductive if your
goal is to improve the situation and not to grandstand.

> IETF views and understands cryptography.

I'll look forward to seeing how you help to make things better.

> a requirement for them to get some independent analysis of whatever

"Independent analysis" exposes your misunderstanding of the IETF.
*You* can do an analysis and write that up in an I-D. And see
Yoav's mail about the TLS renego bug and how many eyeballs missed
that (incl. mine of course). Its nice that you think everything
can be solved easily. Reality tends to disagree.

> Best Practices document through the process in a timely

That's nonsense. UTA has just been speedily chartered.

> Does the IETF have any process to fix or address these issues?

I don't believe those are real queries, but just point-scoring
rhetoric. Do you think such rhetoric is helpful? Ask yourself
if it is or not.

And I would recommend that folks getting involved in the IETF or
IRTF do not start off by getting involved in process issues but
rather dive in to do technical work, writing or reviewing drafts.
(And I don't mean review-as-point-scoring, I mean review with a
goal of improving the outcome.) Its much easier to understand
the limits of process change after you've done some of the
technical work and far far too easy to spout well-meaning
rubbish about process change if you've not.

> guidance on cryptography in the IETF?

Somewhat. I would like to see discussion of how to make it better
and more useful.

> Do you have any ways to improve that guidance or the process leading to it?

I'd love to see the RG discuss that and figure out what they think
is doable. I suggested some topics and others have added what look
like additional reasonable ones.

> having outside groups do it and present the standard to IETF?

Not sure what you mean. But there is IMO good evidence that the
IETF is best at standardising things that were initially done
outside the current WG setup. That maybe wasn't the case say
20+ years ago, and isn't really anything to do with security I
think. Giving IETF WGs a blank sheet from which to start does tend
to result in failure I think. But I'm sure other folks who have
participated might disagree with me on that. I wouldn't say there'd
be a rough consensus on the topic across the IETF nor the
security area.

I don't see how anyone who wasn't participating could offer a
useful opinion on that unless it was the topic of a master's
study or something (some brave souls have done that;-). But
some variation on your question is reasonable to ask, if its
directed towards trying to figure out how to improve our
processes and outputs.

Regards,
S.

PS: Whee-hee - last of many mails from me before the break:-)

---

From: Tao Effect <[email-masked]>
Date: Tue, 24 Dec 2013 11:16:56 -0500

David,

On Dec 24, 2013, at 12:25 AM, David McGrew <[email-masked]> wrote:

> Greg,
> 
> please understand that, to the people who have attended CFRG and IETF meetings with Kevin, it does sound a bit silly to suggest that he is not a real person.   I am not sure why he has not responded on the list, though it is the holiday season in the U.S., which could be the reason.
> 
> David

Do you mean to say that you, and others on this list think that I said that he's not a physical person?

How is such an interpretation of my emails possible? I don't understand.

I've acknowledged Kevin's "realness" multiple times, in several emails. Its the "realness" of his name that I was just curious about, given the reasons already stated across those emails.

Thanks,
Greg