Subject: Re: [pkix] US Patent - Validated SCEP

From: Peter Gutmann <[email-masked]>
Date: Wed, 16 Jul 2014 14:05:42 +0000

Anders Rundgren <[email-masked]> writes:

>http://www.google.com/patents/US8745378
>
>It seem strange that you can get a patent for scheme that validates the
>correctness and authenticity of a certificate request...

Yeah, that'd be almost like someone patenting the wheel:

http://www.newscientist.com/article/dn965-wheel-patented-in-australia.html

Mind you given that this is the USPTO, it's not at all surprising that they'd
issue a patent on part of the SCEP RFC.

(I'm still waiting for the owners of the patent on OCSP to start asserting it
against half the PKI-using world...).

Peter.

---

From: Tomas Gustavsson <[email-masked]>
Date: Fri, 18 Jul 2014 12:50:10 +0200

Bollocks, but shows how USPTO is just a component of the business model 
of corporations. Get some patents to inflate artificial value of the 
company in order to cash in on aquisition...

Just reading the abstract it seem to me that EJBCA source code might be 
prior art?
EJBCA has implemented pre-registration of (SCEP) entities, and comparing 
the PKCS#10 challenge password against the pre-registered one for many 
many years...
But perhaps all the modules need to be named exactly identical (making 
the patent useless of course)?

Cheers,
Tomas

On 2014-07-16 16:05, Peter Gutmann wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

---

From: Santosh Chokhani <[email-masked]>
Date: Fri, 18 Jul 2014 11:48:54 +0000

When I read the patent, I got the impression that it covers matching the SCEP contents with pre-registered contents and not the password.  The background in the patent already acknowledges the existence of password matching.

I do agree that this is a very silly patent and having seen several others, US PTO is in need of total overhaul or should be disbanded. 

-----Original Message-----
From: pkix [mailto:[email-masked]] On Behalf Of Tomas Gustavsson
Sent: Friday, July 18, 2014 6:50 AM
To: [email-masked]
Subject: Re: [pkix] US Patent - Validated SCEP

Bollocks, but shows how USPTO is just a component of the business model of corporations. Get some patents to inflate artificial value of the company in order to cash in on aquisition...

Just reading the abstract it seem to me that EJBCA source code might be prior art?
EJBCA has implemented pre-registration of (SCEP) entities, and comparing the PKCS#10 challenge password against the pre-registered one for many many years...
But perhaps all the modules need to be named exactly identical (making the patent useless of course)?

Cheers,
Tomas

On 2014-07-16 16:05, Peter Gutmann wrote:
>> It seem strange that you can get a patent for scheme that validates 
>> the correctness and authenticity of a certificate request...
>
> Mind you given that this is the USPTO, it's not at all surprising that 
> they'd issue a patent on part of the SCEP RFC.
>
> (I'm still waiting for the owners of the patent on OCSP to start 
> asserting it against half the PKI-using world...).
>
> Peter.
>
>