Subject: Re: [DNSOP] I think we may have a solution - DNSCurve

From: Paul Wouters <[email-masked]>
Date: Mon, 1 Sep 2008 16:49:12 -0400 (EDT)

On Sun, 31 Aug 2008, David Conrad wrote:

> 5. I suspect having encryption will make getting export licenses more  
> complicated.

6. Ellipctic Curve is patent encumbered

Without seeing an RFC style protocol description, it is hard to see
how completely thought out this proposal is, but I think there are
many issues there which are not addressed. Migrations, SEP's vs trusted
chain, offline private key vs not, authenticated denial of existence,
etc etc.

Paul
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Paul Wouters <[email-masked]>
Date: Mon, 1 Sep 2008 16:49:12 -0400 (EDT)

Paul

---

From: bert hubert <[email-masked]>
Date: Mon, 1 Sep 2008 23:13:44 +0200

> 6. Ellipctic Curve is patent encumbered

Perhaps http://cr.yp.to/ecdh/patents.html can shed some light. 

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: bert hubert <[email-masked]>
Date: Mon, 1 Sep 2008 23:13:44 +0200

Bert

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 1 Sep 2008 14:55:26 -0700

>Perhaps http://cr.yp.to/ecdh/patents.html can shed some light.

Or perhaps not. Dan's views of what facts are obvious for patents are 
irrelevant to whether or not someone would want to challenge a 
patent-holder in a costly patent fight; my view are equally 
irrelevant. If Dan's views are correct, many developers who stayed 
away from implementing EC due to patent concerns would have now 
started using EC with his curve due to EC's positive properties 
(faster, less CPU intensive, smaller messages, and so on). A look at 
the market in the three years since Dan introduced Curve25519 will 
show that there has been essentially no significant increase. This 
does not mean that Dan's views of the patent are wrong; it shows that 
vendors are so risk-averse that his views (and my views...) are 
irrelevant to the market.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 1 Sep 2008 14:55:26 -0700

--Paul Hoffman, Director
--VPN Consortium

---

From: Dean Anderson <[email-masked]>
Date: Mon, 1 Sep 2008 23:41:18 -0400 (EDT)

On Mon, 1 Sep 2008, Paul Hoffman wrote:

> patent-holder in a costly patent fight;  

One can't challenge a patent's validity merely by claiming that it is
'irrelevant'; If even one patent claim overlaps your device or program
there is probably a patent case to be found.  By (US) statute, the
patent is presumed valid, though courts seem willing to consider
misconduct by the patent holder, such as deceiving a standards body
(Qualcomm case).  One must challenge a patent by having it re-examined
by the patent office.  When the patent office reverses or amends the
patent, then you've succeeded. Otherwise, you have nothing.

The patent office has reversed many patents on obviousness grounds. My
own view is that there are really very few truly novel patents. Yet
there are indeed truly novel patents and such patents are quite
devastating. But all patents have to be respected.  Certicom appears to
own most (126 I think) patents on elliptic curve crypto, and I've read a
few of their patents. The patents are quite broad, and its hard to
imagine much that isn't covered by their patents.

Things have gotten worse for patents. (well, from my point of view).  
First-to-file means that what you invent can be patented by someone else
if you haven't published your invention suitably to make it prior art.
There is a grandfather clause that gives the true inventor the continued
right to use the technology, but not the right to let others use it.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better sFrom [email-masked]  Mon Sep  1 20:41:26 2008
Date: Mon, 1 Sep 2008 23:41:18 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: Paul Hoffman <[email-masked]>
Cc: [email-masked]
Subject: Re: [DNSOP] I think we may have a solution - DNSCurve
Sender: [email-masked]

On Mon, 1 Sep 2008, Paul Hoffman wrote:

> patent-holder in a costly patent fight;  

One can't challenge a patent's validity merely by claiming that it is
'irrelevant'; If even one patent claim overlaps your device or program
there is probably a patent case to be found.  By (US) statute, the
patent is presumed valid, though courts seem willing to consider
misconduct by the patent holder, such as deceiving a standards body
(Qualcomm case).  One must challenge a patent by having it re-examined
by the patent office.  When the patent office reverses or amends the
patent, then you've succeeded. Otherwise, you have nothing.

The patent office has reversed many patents on obviousness grounds. My
own view is that there are really very few truly novel patents. Yet
there are indeed truly novel patents and such patents are quite
devastating. But all patents have to be respected.  Certicom appears to
own most (126 I think) patents on elliptic curve crypto, and I've read a
few of their patents. The patents are quite broad, and its hard to
imagine much that isn't covered by their patents.

Things have gotten worse for patents. (well, from my point of view).  
First-to-file means that what you invent can be patented by someone else
if you haven't published your invention suitably to make it prior art.
There is a grandfather clause that gives the true inventor the continued
right to use the technology, but not the right to let others use it.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for betterervice?
www.av8.net         faster, more reliable, better service
617 344 9000   

 service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 2 Sep 2008 22:11:39 +0200

On Mon, Sep 01, 2008 at 04:49:12PM -0400,
 Paul Wouters <[email-masked]> wrote 
 a message of 18 lines which said:

> many issues there which are not addressed [...] authenticated denial
> of existence,

Although I agree with your criticism that there is no published
*specification* of DNScurve (wether in Internet-Draft form or else),
this specific issue seems addressed today: DNScurve signs the packet,
not the resource records, and therefore a NXDOMAIN response can be
signed (unlike what happens with DNSSEC).

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 2 Sep 2008 22:11:39 +0200

---

From: David Conrad <[email-masked]>
Date: Tue, 2 Sep 2008 14:48:32 -0700

Bert,

On Aug 31, 2008, at 1:34 PM, bert hubert wrote:
> Technically, this may be true - but I got into trouble over an AES- 
> based
> random generator, even though it does not encrypt any user supplied  
> data.

Back when I was trying to get an early version of BIND shipped with  
RSA BSAFE (around the turn of the century), I got hung up with lawyers  
(coincidentally enough, including the same lawyer DJB used for his  
lawsuit against the US government over cryptography and the lawyer who  
wrote one of the books lawyers used to use for export-related matters)  
trying to figure out if we needed to get a license from the US  
government to export "munitions".  Our approach was to point out  
repeatedly that DNSSEC provided authentication only and not encryption  
(and try to ignore Rivest's "Chaffing and Winnowing" paper).  After  
about a year of fruitless discussion with the Bureau of Export  
Administration, the USG changed their policy and allowed exports with  
a self-declared license for the stuff we were doing.

> It does create problems though.

Not having looked at this (or consulted a lawyer), I would guess  
things would probably be much more complicated today given the current  
political situation as well as the fact that DNSCurve actually does do  
encryption.  But that would only be a guess...

Regards,
-drc

_______________________________________________
DNSOP mailing list
[email-masked] [email-masked]  Tue Sep  2 14:49:35 2008
From: David Conrad <[email-masked]>
To: bert hubert <[email-masked]>
Date: Tue, 2 Sep 2008 14:48:32 -0700
Cc: "[email-masked] WG" <[email-masked]>
Subject: Re: [DNSOP] I think we may have a solution - DNSCurve
Sender: [email-masked]

Bert,

On Aug 31, 2008, at 1:34 PM, bert hubert wrote:
> Technically, this may be true - but I got into trouble over an AES- 
> based
> random generator, even though it does not encrypt any user supplied  
> data.

Back when I was trying to get an early version of BIND shipped with  
RSA BSAFE (around the turn of the century), I got hung up with lawyers  
(coincidentally enough, including the same lawyer DJB used for his  
lawsuit against the US government over cryptography and the lawyer who  
wrote one of the books lawyers used to use for export-related matters)  
trying to figure out if we needed to get a license from the US  
government to export "munitions".  Our approach was to point out  
repeatedly that DNSSEC provided authentication only and not encryption  
(and try to ignore Rivest's "Chaffing and Winnowing" paper).  After  
about a year of fruitless discussion with the Bureau of Export  
Administration, the USG changed their policy and allowed exports with  
a self-declared license for the stuff we were doing.

> It does create problems though.

Not having looked at this (or consulted a lawyer), I would guess  
things would probably be much more complicated today given the current  
political situation as well as the fact that DNSCurve actually does do  
encryption.  But that would only be a guess...

Regards,
-drc

DNSOP@ietorg

f.org

---

From: Mark Andrews <[email-masked]>
Date: Wed, 03 Sep 2008 11:33:54 +1000

> signed (unlike what happens with DNSSEC).

	A NXDOMAIN response if cyptographically proved with DNSSEC.

	There are other rcodes that DNSSEC does not cover but NXDOMAIN
	is not one of them.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Mark Andrews <[email-masked]>
Date: Wed, 03 Sep 2008 11:33:54 +1000

Mark

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 3 Sep 2008 09:13:00 +0200

On Wed, Sep 03, 2008 at 11:33:54AM +1000,
 Mark Andrews <[email-masked]> wrote 

> 	A NXDOMAIN response if cyptographically proved with DNSSEC.

There are two possibilities:

1) I understand nothing to DNSSEC (this is quite possible, giving my
experience with it and the complexity of the protocol).

2) You are playing with words.

"The domain example.org does not exist" can be cyptographically proved
with DNSSEC, that's correct. But you need NSEC* records to do so, you
cannot directly sign a NXDOMAIN response.
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 3 Sep 2008 09:13:00 +0200

---

From: Roy Arends <[email-masked]>
Date: Wed, 3 Sep 2008 12:23:08 +0100

> cannot directly sign a NXDOMAIN response.

Mark is not playing with words. His statement is absolutely correct.  
He did not state nor imply that the NXDOMAIN response is _signed_, nor  
that rcode=3 (name error) is _signed_.

The header is indeed not signed with DNSSEC. The header includes the  
RCODE, therefor the RCODE is not signed.

What can be _proved_ by validating a combination of records (an  
NXDOMAIN response), is that the rcode=3 (name error) is correct or not.

I see Mark's message as a clarification, not a rebuttal.

Roy

---

From: Roy Arends <[email-masked]>
Date: Wed, 3 Sep 2008 12:23:08 +0100

Roy