For what it's worth we on the Bouncy Castle project have managed to implement most of the SM* standards already. I'll admit there were some minor language issues (ignorance on our part), but for most of us I think we'd agree that maths and tests vectors (while still based around ASCII Hex/base64) are really quite familiar in any language (now at least) and in most cases all that are required to produce a working implementation. So we believe our C#, Java APIs, and Kotlin APIs can already produce signatures, and certificates, in line with the current draft for SM TLS 1.3 Cipher Suite already. We'd certainly welcome feedback on whether we've been successful as well. The code is available under https://github.com/bcgit
I would stress that this is not to say that there are not subtletys around parameter choices that can be missed in trying to manage a standard in another language (parameter choices that can affect security for example), but if the first stage is interop and there is a mechanism for validation, interop can easily dealt with. After that it's about validation. Validation is going to be about something that rules out invalid parameter choices and chooses representative test vectors. It's rarely about a standards document though. I can understand the pain about the cost of ISO standards as well, but having gone down the FIPS path also one realizes it's more about what you test against than where you got the description of what you implemented from, to that end a "not so definitive standard" can fill in the gap. Even if you have the definitive reference it's still easy to get it wrong, sometimes standard authors don't write the things we need to hear, ultimately it's really about testing and analysis. Regards, David On 28/8/19 10:24 pm, Hubert Kario wrote: > On Monday, 19 August 2019 17:05:06 CEST Watson Ladd wrote: >> Dear all, >> >> I see no reason why English alone should be accepted for standards >> documents we reference. French and German pose few difficulties, and one >> can always learn Russian. >> >> What I don't know is how difficult Mandarin is at a level to read a >> standards document. I expect the mechanics of using the dictionary to >> dominate. > I am familiar with few languages, the issue is even finding dictionary able > to > translate the technical terms correctly. Specialist texts are full of jargon > and jargon is very hard to translate correctly. It's not as simple as > chucking > the text sentence by sentence at google translate[1] and fixing few grammar > mistakes. > >> I'm concerned about the traceability of unofficial Englidh PDFs on some >> website: could the Chinese body responsible host them instead? >> >> I fully expect this to be a more general IETF problem. > one of the primary objectives of IETF is interoperability > > given that, and the fact the the TLS specification is written in English, > there should be a specification of any algorithm that is supposed to be > integrated with it and published under the auspice of IETF to also be > available in English > > it's a matter of practicality, not politics > > 1 - other automated internet translation services are available > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
