Re: Crypto review of DH-CHAP

[Paul Koning <ni1d@arrl.net>]

Excerpt of message (sent 4 April 2002) by David Jablon:
> David,
> 
> A couple times you mentioned that there would be some delay due to
> "cryptographic review".  While some initial checking is a smart thing,
> I certainly hope that the posting of draft-00 of DH-CHAP is not being
> further delayed for this reason.
> 
> Extensive cryptographic review of the proposal shouldn't be needed at all,
> especially if it's just a simple a combination of old tried-and-true methods.

I don't agree with that at all.

There is no such thing as "just a simple combination" in security
protocols. 

> And if some measure of cryptographic review is needed, too much back-room
> finagling is a waste of time, since legitimate review has to be done in an
> open process.  We all know of the dramatic failures that can result
> from closed-process crypto standards efforts.

Agreed.

	paul