Subject: [TLS] On the difficulty of technical Mandarin (SM3 related)

From: Watson Ladd <[email-masked]>
Date: Mon, 19 Aug 2019 08:05:06 -0700

Dear all,

I see no reason why English alone should be accepted for standards
documents we reference. French and German pose few difficulties, and one
can always learn Russian.

What I don't know is how difficult Mandarin is at a level to read a
standards document. I expect the mechanics of using the dictionary to
dominate.

I'm concerned about the traceability of unofficial Englidh PDFs on some
website: could the Chinese body responsible host them instead?

I fully expect this to be a more general IETF problem.

Sincerely,
Watson

---

From: Kyle Rose <[email-masked]>
Date: Mon, 19 Aug 2019 12:24:01 -0400

Moving tls to bcc, and adding rfc-interest. (This is the kind of discussion
that is likely to ignite a dumpster fire, and it's not specific to TLS
work.)

> I fully expect this to be a more general IETF problem.

For purely practical reasons, within a knowledge domain it makes sense to
have a single language in which normative documents are written, with
fluency in that language an implicit requirement of direct participation.
Otherwise, the number of people who will be able to contribute to IETF work
(writing or reviewing) will be very small, limiting the throughput, shared
knowledge base, and overall utility of the SDO.

For historical reasons, that single language is English. This isn't
something unique to the IETF, either: for a variety of reasons too numerous
to cover here, English has become the default shared language in a
multilingual world when actual work needs to get done between people with
different native tongues. The IETF exists in this reality: fair or not,
there's really no other practical choice.

Informational documents and upstream references are maybe a different story
as they are not required to implement IETF protocols, but I suspect similar
issues would crop up even there, given how important many informational
documents are.

Kyle

---

From: Mike Bishop <[email-masked]>
Date: Wed, 21 Aug 2019 18:18:07 +0000

The actual requirement in RFC 8126 doesn’t say the public specification needs to be in English, but it does say that “the designated expert will review the public specification.”  This suggests that whatever language the authoritative specification might be posted in, the designated expert needs to be able to understand it and/or the WG would need to designate an alternate expert able to review it appropriately.

Obviously, given that the IETF works in English, an authoritative English-language specification makes that easier to achieve.  But a translation, even one hosted by a responsible body, almost always contains verbiage that only the original language is considered authoritative.

From: TLS <[email-masked]> On Behalf Of Watson Ladd
Sent: Monday, August 19, 2019 11:05 AM
To: TLS List <[email-masked]>
Subject: [TLS] On the difficulty of technical Mandarin (SM3 related)

Dear all,

I see no reason why English alone should be accepted for standards documents we reference. French and German pose few difficulties, and one can always learn Russian.

What I don't know is how difficult Mandarin is at a level to read a standards document. I expect the mechanics of using the dictionary to dominate.

I'm concerned about the traceability of unofficial Englidh PDFs on some website: could the Chinese body responsible host them instead?

Sincerely,
Watson

---

From: Hubert Kario <[email-masked]>
Date: Wed, 28 Aug 2019 14:24:13 +0200

> standards document. I expect the mechanics of using the dictionary to

I am familiar with few languages, the issue is even finding dictionary able to 
translate the technical terms correctly. Specialist texts are full of jargon 
and jargon is very hard to translate correctly. It's not as simple as chucking 
the text sentence by sentence at google translate[1] and fixing few grammar 
mistakes.

> I fully expect this to be a more general IETF problem.

one of the primary objectives of IETF is interoperability

given that, and the fact the the TLS specification is written in English, 
there should be a specification of any algorithm that is supposed to be 
integrated with it and published under the auspice of IETF to also be 
available in English

it's a matter of practicality, not politics

 1 - other automated internet translation services are available
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: David Hook <[email-masked]>
Date: Thu, 29 Aug 2019 00:47:09 +1000

For what it's worth we on the Bouncy Castle project have managed to
implement most of the SM* standards already. I'll admit there were some
minor language issues (ignorance on our part), but for most of us I
think we'd agree that maths and tests vectors (while still based around
ASCII Hex/base64) are really quite familiar in any language (now at
least) and in most cases all that are required to produce a working
implementation. So we believe our C#, Java APIs, and Kotlin APIs can
already produce signatures, and certificates, in line with the current
draft for SM TLS 1.3 Cipher Suite already. We'd certainly welcome
feedback on whether we've been successful as well. The code is available
under https://github.com/bcgit

I would stress that this is not to say that there are not subtletys
around parameter choices that can be missed in trying to manage a
standard in another language (parameter choices that can affect security
for example), but if the first stage is interop and there is a mechanism
for validation, interop can easily dealt with. After that it's about
validation. Validation is going to be about something that rules  out
invalid parameter choices and chooses representative test vectors. It's
rarely about a standards document though.

I can understand the pain about the cost of ISO standards as well, but
having gone down the FIPS path also one realizes it's more about what
you test against than where you got the description of what you
implemented from, to that end a "not so definitive standard" can fill in
the gap. Even if you have the definitive reference it's still easy to
get it wrong, sometimes standard authors don't write the things we need
to hear, ultimately it's really about testing and analysis.

Regards,

David

On 28/8/19 10:24 pm, Hubert Kario wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 28 Aug 2019 15:49:12 +0000

Is there any chance you could post some samples.  It would be wonderful if the Alibaba folks would work to make a “test vectors” draft, using your data.  Hint hint.