Crypto Forum Research Group

Crypto Forum Research Group
Name	Crypto Forum Research Group
Formation	1996
Type	Research group
Location	Global
Parent organization	Internet Engineering Task Force

Crypto Forum Research Group

The Crypto Forum Research Group is a specialist research group within the Internet Engineering Task Force focused on cryptographic mechanisms, protocol design, and security analysis, interacting with standards bodies such as the Internet Architecture Board, the Internet Research Task Force, the World Wide Web Consortium, and the International Organization for Standardization. It advises working groups like the Transport Layer Security Working Group, the JSON Web Token Working Group, the OAuth Working Group, the Domain Name System Extensions Working Group, and collaborates with academic institutions such as the Massachusetts Institute of Technology, Stanford University, the University of Cambridge, and INRIA. The group engages vendors including Cisco Systems, Google, Microsoft, Mozilla, and major open source projects such as OpenSSL, BoringSSL, LibreSSL, and the GNOME Project.

Overview

The group operates under the umbrella of the Internet Engineering Task Force and reports findings relevant to the Internet Architecture Board and the IETF Security Directorate while coordinating with the World Wide Web Consortium, the International Telecommunication Union, the European Telecommunications Standards Institute, and the Cloud Security Alliance. Its remit encompasses symmetric cryptography, public-key infrastructures, authenticated encryption, key exchange, digital signatures, and randomness sources with cross-cutting relevance to protocols like Transport Layer Security, Secure Shell, Internet Protocol Security, Datagram Transport Layer Security, and QUIC. Members publish research that intersects with academic venues such as the IEEE Symposium on Security and Privacy, the ACM Conference on Computer and Communications Security, the Crypto conference, the Eurocrypt conference, and the Real World Crypto symposium.

Organization and Membership

Membership includes participants from industry, academia, and standards organizations such as Google, Microsoft, Mozilla, Cisco Systems, Cloudflare, Amazon Web Services, Facebook (Meta), Intel, ARM Holdings, Red Hat, Oracle, and academic labs at Carnegie Mellon University, ETH Zurich, University of California Berkeley, University of Oxford, and ETH Lausanne. Leadership roles have been held by individuals affiliated with institutions including the Internet Engineering Steering Group, the IAB, and national research labs like NIST and GCHQ; liaison relationships extend to the National Institute of Standards and Technology, the European Central Bank's IT departments, the OpenSSL Software Foundation, the IETF Applications Area Directorate, and regional bodies such as the Asia Pacific Network Information Centre. The group follows IETF processes such as working group charters, mailing lists overseen by the IETF Secretariat, and plenary participation at IETF meetings in venues like Prague, Singapore, London, and Montreal.

Research Activities and Projects

Research outputs include analyses of algorithmic primitives such as AES, ChaCha20, Poly1305, RSA, Elliptic Curve Digital Signature Algorithm, Ed25519, X25519, and post-quantum candidates coming from projects like CRYSTALS-Kyber, Dilithium, Falcon, and NTRU, with testing methodologies drawing on suites from NIST, ENISA, and ETSI. The group studies protocol mechanisms including Certificate Transparency, DNSSEC, DANE, OCSP, Online Certificate Status Protocols, CMS, S/MIME, JSON Web Encryption, and JSON Web Signatures, and contributes to implementations in OpenSSH, OpenVPN, WireGuard, BoringSSL, LibreSSL, and GnuTLS. It coordinates interoperability testing with events modeled on the IETF Hackathons, collaborates with research programs at the National Institute of Standards and Technology and with testbeds such as those run by the European Telecommunications Standards Institute, and produces documents that influence RFCs, Internet-Drafts, and informational reports cited by the World Wide Web Consortium and the IRTF.

Standards and Contributions to Cryptography

Contributions have influenced IETF standards including multiple revisions of Transport Layer Security, updates to the Public Key Infrastructure standards, guidance on Authenticated Encryption with Associated Data, and best current practice documents that reference work from the Internet Research Task Force, the IAB, the Internet Society, and national cryptographic agencies such as NIST and GCHQ. The group’s analyses have informed decisions about deprecating obsolete algorithms like RC4 and MD5, promoting AES-GCM and ChaCha20-Poly1305, and advising on migration paths toward post-quantum algorithms proposed in NIST’s post-quantum cryptography standardization. Liaison outputs have been used by the World Wide Web Consortium in WebCrypto API discussions, by the OpenID Foundation in token security guidance, and by the CA/Browser Forum in certificate policy deliberations.

Meetings and Workshops

Regular discussions occur on IETF mailing lists and at IETF meetings, with in-person workshops and interim meetings co-located with events like the IEEE Symposium on Security and Privacy, ACM CCS, and Real World Crypto; additional collaborations have taken place at venues hosted by the Internet Research Task Force, the World Wide Web Consortium, and academic conferences at Stanford, MIT, ETH Zurich, and the University of Cambridge. The group organizes focused workshops on topics such as post-quantum readiness, randomness sources, side-channel resistance, threshold cryptography, and secure multiparty computation, often involving stakeholders from the Cloud Security Alliance, OWASP, the OpenSSL Project, and major vendors including Google, Microsoft, and Amazon.

Criticism and Controversies

Critiques have arisen regarding the pace of standardization compared to academic research as seen in debates at venues like Crypto, Eurocrypt, and Real World Crypto, disagreements over algorithm choices paralleling controversies involving NIST, the NSA, and national security agencies, and concerns about industry influence echoing disputes seen in the CA/Browser Forum and the IETF’s handling of privacy trade-offs. Public controversies have touched on implementation vulnerabilities reported in OpenSSL, Heartbleed-era debates involving the Core Infrastructure Initiative, and tension between backward compatibility and security modernization similar to discussions at the Internet Architecture Board and the IETF Security Directorate.

Category:Internet Engineering Task Force