78
T. Ashur and A. Luykx
voted to approve the draft (some with comments), and 8 voted to disapprove. The
Disposition of Comments was not distributed prior to the meeting and was made
available to participants only in the meeting itself. The project editors could not
attend the meeting in-person and the editing session was performed via Skype. At
this point, it was made clear that the editors had given up on reaching consensus.
They refused to address the concerns raised by the NBs, and simply said that they
requested that a 4th PDAM be circulated. In response, some of the experts suggested
that since it is clear that a consensus cannot be reached due to the refusal to provide
further information, the project should be canceled.
Following a discussion about the proper procedure to make this decision, the
WG2 conveners decided to hold an internal vote. Each country participating in the
meeting would cast a single vote for one of the following options: (1) cancel the
project; (2) proceed to a 4th PDAM; and (3) abstain. Of the 16 countries represented
in the room, 8 voted to cancel the project, 4 voted to move to a 4th PDAM, and 4
abstained. This decision was later ratified by SC27, the parent committee to WG2.
The justification for cancellation reads:
Working Group 2 (WG 2) feels that both algorithms included in the amendment are not
properly motivated and their security properties are not sufficiently understood. An attempt
was made by the designers to publish a design rational (ePrint 2017/560) which was not
enough to convince WG 2 experts. Requests to disclose additional information about the
way the algorithms were designed were refused by the designers.
It appears that a stalemate has been reached where the amendment cannot reach the
required majority of 66% to move from PDAM to DAM stage. This issue seems to already
reflect badly on ISO’s reputation in what media attention it receives. It also has an adverse
effect on the collaborative nature of the work within ISO which seems to polarize around
this and spill over onto other projects. Therefore, WG 2 experts believe that it is best to
cancel the project and not standardize these algorithms.
WG 2 wishes to convey that not including the algorithms in ISO/IEC JTC 1/SC 27
standards is not a statement about the security or the quality of the algorithms nor about
the work done by the designers nor the editors. Since the decision to move forward from a
PDAM stage requires consensus decision (even if not unanimity) it simply means that given
the available information and the opposing opinions about the security of the algorithms
they do not enjoy the level of confidence required for inclusion in ISO/IEC JTC 1/SC 27
standards.
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0
International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing,
adaptation, distribution and reproduction in any medium or format, as long as you give appropriate
credit to the original author(s) and the source, provide a link to the Creative Commons licence and
indicate if changes were made.
The images or other third party material in this chapter are included in the chapter’s Creative
Commons licence, unless indicated otherwise in a credit line to the material. If material is not
included in the chapter’s Creative Commons licence and your intended use is not permitted by
statutory regulation or exceeds the permitted use, you will need to obtain permission directly from
the copyright holder.
T. Ashur and A. Luykx
voted to approve the draft (some with comments), and 8 voted to disapprove. The
Disposition of Comments was not distributed prior to the meeting and was made
available to participants only in the meeting itself. The project editors could not
attend the meeting in-person and the editing session was performed via Skype. At
this point, it was made clear that the editors had given up on reaching consensus.
They refused to address the concerns raised by the NBs, and simply said that they
requested that a 4th PDAM be circulated. In response, some of the experts suggested
that since it is clear that a consensus cannot be reached due to the refusal to provide
further information, the project should be canceled.
Following a discussion about the proper procedure to make this decision, the
WG2 conveners decided to hold an internal vote. Each country participating in the
meeting would cast a single vote for one of the following options: (1) cancel the
project; (2) proceed to a 4th PDAM; and (3) abstain. Of the 16 countries represented
in the room, 8 voted to cancel the project, 4 voted to move to a 4th PDAM, and 4
abstained. This decision was later ratified by SC27, the parent committee to WG2.
The justification for cancellation reads:
Working Group 2 (WG 2) feels that both algorithms included in the amendment are not
properly motivated and their security properties are not sufficiently understood. An attempt
was made by the designers to publish a design rational (ePrint 2017/560) which was not
enough to convince WG 2 experts. Requests to disclose additional information about the
way the algorithms were designed were refused by the designers.
It appears that a stalemate has been reached where the amendment cannot reach the
required majority of 66% to move from PDAM to DAM stage. This issue seems to already
reflect badly on ISO’s reputation in what media attention it receives. It also has an adverse
effect on the collaborative nature of the work within ISO which seems to polarize around
this and spill over onto other projects. Therefore, WG 2 experts believe that it is best to
cancel the project and not standardize these algorithms.
WG 2 wishes to convey that not including the algorithms in ISO/IEC JTC 1/SC 27
standards is not a statement about the security or the quality of the algorithms nor about
the work done by the designers nor the editors. Since the decision to move forward from a
PDAM stage requires consensus decision (even if not unanimity) it simply means that given
the available information and the opposing opinions about the security of the algorithms
they do not enjoy the level of confidence required for inclusion in ISO/IEC JTC 1/SC 27
standards.
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0
International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing,
adaptation, distribution and reproduction in any medium or format, as long as you give appropriate
credit to the original author(s) and the source, provide a link to the Creative Commons licence and
indicate if changes were made.
The images or other third party material in this chapter are included in the chapter’s Creative
Commons licence, unless indicated otherwise in a credit line to the material. If material is not
included in the chapter’s Creative Commons licence and your intended use is not permitted by
statutory regulation or exceeds the permitted use, you will need to obtain permission directly from
the copyright holder.