Re: [Cfrg] Obligations of Candor

Generally, I think that's a good policy, because it adds support to individuals.

I also think it should include guidance on the form of disclosure.

As the Certicom rep in the incident you cited, I recall telling ANSI X9F1 verbally  about the security issue, though I am not sure when.  I had thought my IACR eprint would serve a‎s adequate public disclosure: but that's where guidance may have helped me.

Best regards, 

-- Dan
  Original Message  
From: Watson Ladd
Sent: Sunday, June 15, 2014 9:25 AM
To: cfrg@irtf.org
Subject: [Cfrg] Obligations of Candor

Dear all,

I would like to see an addition to the IETF rules: participants must
fully disclose security issues with the standard they are aware of, in
all standards bodies they participate in, at the time of the Last Call
for a standard. Such disclosure must be to all members of the
committee developing the standard, and, in the event such a security
issue remains post-ratification, public.

This is motivated by the discovery that Certicom, in particular,
patented a backdoor in Dual EC, and proceeded not to tell anyone. No
doubt I have bumbled the above rule: but I would like to start
discussion of what sort of rule we require to ensure that participants
do not horde vulnerabilities, only to exploit them after the standard
is ratified.

Sincerely,
Watson Ladd

_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
http://www.irtf.org/mailman/listinfo/cfrg

Re: [Cfrg] Obligations of Candor

Attachment: smime.p7s