Subject: Re: DNSEXT Minutes @ IETF-63

From: Dean Anderson <[email-masked]>
Date: Sun, 4 Sep 2005 18:17:45 -0400 (EDT)

On Thu, 1 Sep 2005, Ólafur Guðmundsson wrote:
> Both documents have had an IPR claim filed against them. The patent
> this has been issued in one country at the moment (Israel) but filed
> in some other countries as well, just not approved (yet). There is a
> license available that is royalty free, but does have some terms. So
> implementors either don't know what to do or are ignoring it.

Factor GATT requirements into that. Many countries have agreed [under
GATT] to accept patents issued by other countries, so those patents are
[or will be] enforceable in other GATT countries. [yes, GATT is truely
evil, but that's another story]. You should assume that all patents
propogate to all "civilized"  countries.

> Donald Eastlake presents some drafts about cryptographic algorithms.
> 
> First something about draft-ietf-dnsext-ecc-key-07:
> There have been some questions in the past about patents, but
> as far as is known, these only cover specific implementations, not on the
> basic theory or scheme of it, perhaps on specific equations. 

Umm, <speaking as LPF President> software patents almost never only cover
specific implementations (ie object code). The issues are how fundamental
the patent is and how broad the patent claims are.  Do you have the patent
numbers for the subject patents?

BTW, one more word of software patent advice: Don't do patent searches,
unless you are patenting something.  Because having done a patent search
[and presumably thinking you've not found anything infringing] is actually
evidence against you for intentional infringement, which carries more
severe penalties.  Once you've admitted that you aren't [or just shouldn't
be] completely ignorant of the infringed patent, you better be sure you
are right. It is usually best to be completely ignorant of the patents so
any infringement is unintentional. [BTW this is an argument against the
patent system--it can't benefit the development of science and technology]

Another patent issue to be aware of: Some patent lawyers think that
possession of [free] software implementations of patented software
infringe on patents. I'll present a summary of both views as accurately as
I can.

Commercial and private usage for non-research purposes plainly does
infringe, but source code possession and research is not so clear.  For
example, the OpenSSL distribution before the RSA patents expired.  I don't
think it is the case that source code possession infringes, but its a view
in dispute and untested in court. My view is based on the notions: That
description of patented technology does not infringe; That you are allowed
to patent enhancements to prior-patents and the prior-patent holder cannot
prevent this; And that a working model must be available at the time of
patent submission---you cannot patent a hypothetical device.

There is an explicit right to have a description of the patented
technology and source code is descriptive of software patents. There must
also be an implicit right that you are that you can use the prior-patented
technology for research on an enhancement, and that you also must be
allowed to use the included prior-patented technology for submission of
your enhancement to the patent office for patenting of your enhancement.
Otherwise, you could not patent an enhancement without the prior-patent
holders' permission, which seems to violate the law allowing such
enhancements.

But as I said, there are expert lawyers with learned opinions who
disagree.  Their view is based on the notion that patent gives one an
absolute, exclusive right over the control of the technology during the
term of the patent. In other words, they have a right not to license, and
if they choose, a right to preventing entirely the private sector use of
the patented technology.  They would probably argue that if you haven't
submitted a patent application, your research isn't really research but
just private usage that they are entitled to prohibit. In verbal "banter"
with such lawyers, some denied entirely any implicit right to research,
which I thought a more dubious position. There is also an argument that
source code aids infringement, particularly binaries [This is also why I
find Kazaa, etc 'aiding' arguments so disturbing, besides other reasons].
There is some support for these views, and for non-trivial conflict in
court. So far, these views are untested. You should consult your lawyer
before deciding on a course of action which could put you at risk.  (And
of course, you should also support the LPF and help abolish software
patents. ;-)

I should add that Av8 Internet and a couple other sites went so far as to
mirror OpenSSL for research in the US before the RSA patents expired
(while using only a patent-licenced version). RSA did not react. However,
this does not conclusively mean anything.

So much for the 2005 patent lecture.... ;-)

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Mon, 5 Sep 2005 04:28:19 +0000

thanks Dean.   I'll file this under "arm-chair legal advice"....
 the folks who do this for a living have given good advice to me
 on the implementation we are building.  

 The best advice one can give, unless its from a competent attorney
 who deals in IPR issues, is to get such advice.  Advice from a 
 mailing list is ... less than credible.

--bill

---

From: Thierry Moreau <[email-masked]>
Date: Thu, 08 Sep 2005 16:27:23 -0400

Ólafur Guðmundsson wrote:

> 
> Minutes of the DNSEXT working group
> 63rd IETF, Paris, France
> 
> [...]
> 
> Automatic Updates of DNSSEC trust anchors
> =========================================
> 
> Olafur Gudmundsson reports that having no key management standard
> might become the next excuse for not deploying DNSSEC. Early adaptors
> may need to bear additional costs configuring trust anchors. The need
> for configured trust anchors will never disappear, in the best case it
> might be reduced to only one anchor, the root. Olafur pleas to the
> working group for more activity here. Authors are frustrated with the
> complete silence on this issue, they cannot continue until there is
> discussion, feedback, a list of selection criteria and a time line.

Well, a different approach to the DNS trust anchor renewal has been 
presented on august 24 to a DNS deployment mailing list ... with 
complete silence as well. I was (naively) hoping some feedback from 
those early adopters before submitting this as an IETF contribution.

The trust anchor key management is similar to the distribution of X.509 
root key certificate. In this area, an IETF draft has been prepared, 
i.e. http://www.ietf.org/internet-drafts/draft-moreau-pkix-takrem-00.txt 
(verion -01 has been submitted today, following comments by Stephen Kent).

For DNS, there are more protocol details for adopting a trust anchor 
rollover scheme like TAKREM ("these details matter tremendously" - Sam 
Weiler). So I prepared a document, see
http://www.connotech.com/takrem_for_dnssec_01.pdf
Title: ‘Trust Anchor’ Integrity Mechanisms for Internet DNS Security

In this document, a new RR id defined, SDDA for "SEP DNSKEY Direct 
Authenticator," with a fairly generic format, and two uses of the SDDA 
RR are suggested, including TAKREM for trust anchor key renewal.

This proposal is both new and comprehensive. The document can be turned 
into an Internet-Draft, but this would need some feedback and discussion.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]