Subject: Re: [pkix] US Patent - Validated SCEP

From: Peter Gutmann <[email-masked]>
Date: Sat, 19 Jul 2014 05:32:28 +0000

Tomas Gustavsson <[email-masked]> writes:

>Just reading the abstract it seem to me that EJBCA source code might be prior
>art?

So is the cryptlib source code (and user manual) in every version for the last
fifteen years.  Mind you given that they ignored prior art like this:

http://www.historyandcivilization.com/publishImages/Picture-Gallery---Assyria---Neo-Babylonia---Sculpture---Friezes~~element54.jpg

when issuing the wheel patent it's not surprising they allowed this one
through.  

Certified Security Solutions looks like a Windows consulting firm who's using
the patent as an attempt to make money off this (which they themselves
reported):

http://www.kb.cert.org/vuls/id/971035

via this (a CSS product):

http://www.css-security.com/vscep/

however if you look at the vendor information in the original advisory, every
single vendor claims they're not vulnerable (except for one "unknown"), which
would imply that every SCEP implementation out there is prior art for this
patent.  In particular I like their "solution" in the vuln.note:

  Solution

  We are currently unaware of a practical solution to this problem.

Well the solution is "don't allow a SCEP client to put arbitrary stuff into
its cert requests", this is so obvious that my code has done it since it was
first written.

Peter.