Subject: Re: [TLS] [Ietf-honest] Last Call: draft-ietf-tls-extractor (Keying Material Exporters for Transport Layer Security (TLS)) to Proposed Standard

From: Matthew Campagna <[email-masked]>
Date: Thu, 23 Jul 2009 13:54:36 -0400

Todd,

 The official statement is the linked document, we update it from time to time. 

Regards,
   Matt

----- Original Message -----
From: Todd Glassey <[email-masked]>
To: Dean Anderson <[email-masked]>
Cc: Matthew Campagna; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Sent: Thu Jul 23 13:37:07 2009
Subject: Re: [Ietf-honest] [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exporters for Transport Layer Security (TLS)) to	Proposed Standard

Dean Anderson wrote:
> On Wed, 22 Jul 2009, Matthew Campagna wrote:
>
>   
>> In Hopes of Clarifying,
>>
>>    Since I filled out the form in question I would hope that you
>> consider these comments with a little more weight than others' wild
>> speculations about the intention of IPR #1154.
>>
>>    I do not read that IPR #1154 claims to have patents that cover the
>> draft-ietf-tls-extractor, and perhaps more importantly, nor was it my
>> intention to indicate any such claims.
>>
>>     
Matthew -
I dont want to know your intentions were when you filed it but what I do 
want to know is what Certicom's commitment's are and in writing - and 
here is the key thing - it has to formally come from someone legally 
empowered by the Corporation to do so.

Otherwise (no offense meant) what you personally want is irrelevant 
unless you are specifically the inventor and are reclaiming that IP...
>
> The above is a good statement about your intent with regard to patent 
> claims on draft-ietf-tls-extractor.
>
>
>   
>>    I do recognize that it is listed in the section
>>
>>    IV. IETF Document or Other Contribution to Which this IPR Disclosure Relates:
>>
>>   I believe this to be correct as the free license being offered
>> extends a license to use the following suites, to which we are making
>> some claims,
>>
>> 	A. "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security(TLS)" RFC 4492, May 2006; or,
>> 	B. “TLS Elliptic Curve Cipher Suites with SHA‐256/384 and AES Galois Counter Mode,” RFC 5289, or
>> 	C. “Suite B Cipher Suites for TLS,” draft‐rescorla‐tls‐suiteb‐ 07.txt;
>>
>>   if one wants to use them in the draft-ietf-tls-extractor, under the
>> conditions in a linked document.  Hence, I believe that the license is
>> extending intellectual property rights that 'relates' to
>> draft-ietf-tls-extractor.  I do not equate 'relates' to claiming
>> rights over.
>>     
>
> I don't think this is what is meant by "relates". If lower protocol
> layers "related" to the above cipher suites, then IP (RFC791) and TCP
> (RFC793) also "relate" in the same way, and you did not list those
> drafts.
>
>
>   
>>   I do read that IPR #1154 claims to have patents that cover parts of
>> documents listed in,
>>
>>    V Disclosure of Patent Information (i.e., patents or patent
>> applications required to be disclosed by Section 6 of RFC 3979)
>>
>>      C If an Internet-Draft or RFC includes multiple parts and it is
>> not reasonably apparent which part of such Internet-Draft or RFC is
>> alleged to be covered by the patent information disclosed in Section
>> V(A) or V(B), it is helpful if the discloser identifies here the
>> sections of the Internet-Draft or RFC that are alleged to be so
>> covered:
>>
>>   Where it lists:
>>
>>   RFC 3278, RFC 4109, RFC 4492, RFC 4753, RFC 4754, RFC 4869, RFC
>> 5008, RFC 5289, draft-rescorla-tls-suiteb-12,
>> draft-green-secsh-ecc-07, draft-igoe-secsh-suiteb-00,
>> draft-ietf-smime-3278bis-07, draft-ietf-smime-sha2-11
>>
>>   Note that draft-ietf-tls-extractor is not listed in the I-D or RFCs
>> part of which the listed patents claim to cover.
>>
>> Therefore a reasonable person should be able to conclude that the
>> statement is not making a claim that patents listed cover parts of the
>> draft-ietf-tls-extractor.
>>     
>
> It is good to know that this is your interpretation; that you mean
> that there are patent claims only on 
>   RFC 3278, 
>   RFC 4109, 
>   RFC 4492, 
>   RFC 4753, 
>   RFC 4754, 
>   RFC 4869, 
>   RFC 5008, 
>   RFC 5289, 
>   draft-rescorla-tls-suiteb-12,
>   draft-green-secsh-ecc-07, 
>   draft-igoe-secsh-suiteb-00,
>   draft-ietf-smime-3278bis-07, 
>   draft-ietf-smime-sha2-11
>
> These documents (only these documents) should be listed in Section IV.
>  
> If you read the instructions for Section V.C, it is plain that you are
> to identify "sections of the Internet-Draft or RFC that are alleged to
> be so covered:", and you don't identify any sections.
>
> If you have no patent claims on a draft, there should not be an IPR
> disclosure on that document, except perhaps to make clear (via the
> additional notes in Section V) that you have no patent claims on a
> document.
>
>   
>>   As stated prior, I think the form being used creates the confusion
>> at hand.  There is no clear definition of what should be in section IV
>> versus section V. C.  Should more exact language be added to the form,
>> I would be happy to update the IPR statement to help remove some
>> stated uncertainties.
>>     
>
> It appears that your interpretation of Section IV, V and Section V.C
> cannot be correct by reading the text for those sections. You apparently
> did not read the instructions carefully.  If one isn't going to read the
> text there now, there is no point in adding more text.
>
>   
>>   Further the RFC 3979 indicates the following:
>>
>> 6.3.  How Must a Disclosure be Made?
>>
>>    IPR disclosures are made by following the instructions at
>>    http://www.ietf.org/ipr-instructions. 
>>
>> A link I think most will find particularly amusing.
>>     
>
> I didn't find the link amusing. I rather expected that you had found a
> dead link or something, but that isn't the case. 
>
> The link you cite provides contact information and directs one to the
> disclosure template, which you filled out.  On that template, Section
> V.C contains the same instructions as appear on the Disclosure.
>
> ====================== 
> C. If an Internet-Draft or RFC includes multiple parts and it is not 
> reasonably apparent which part of such Internet-Draft or RFC is alleged 
> to be covered by the patent information disclosed in Section V(A) or 
> V(B), it is helpful if the discloser identifies here the sections of the 
> Internet-Draft or RFC that are alleged to be so covered: 
> ====================== 
>
> Your interpretation of Section V.C cannot be correct by reading the text
> for section V.C on the template. One wonders if you took the proper time
> and solemnity to prepare the Certicom disclosures.
>
> But I guess we have the information we need, now. Thanks. I hope you
> quickly update the IPR disclosure to comply with the instructions for
> each section and the actual facts Certicom is supposed to convey for
> those sections.  Given the confusion so far, I think you will need to
> add a comment for each document previously incorrectly listed in Section
> IV for which there are no patent claims, clearly stating the fact of no
> patent encumbrance on those specific documents.  Once that is done, and
> it is clear there are no patent encumbrances on the extractor draft, I
> will be happy to reconsider my objection to the extractor draft.
>
> 		--Dean
>
>
>
>
>   
> ------------------------------------------------------------------------
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com 
> Version: 8.5.392 / Virus Database: 270.13.25/2256 - Release Date: 07/23/09 06:02:00
>
>

---

From: Dean Anderson <[email-masked]>
Date: Thu, 23 Jul 2009 15:11:52 -0400 (EDT)

>  The official statement is the linked document, we update it from time to time. 

This is a problem. The official statement is the IPR disclosure, which
should contain the terms used by the IETF in its decision to approve the
document. Certicom should not be able to alter the terms after the fact,
which it seems to have just admitted doing.

I think that we have to consider rejecting documents where the terms are
not definite and/or can be altered at the whim of the patent holder.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 23 Jul 2009 14:15:06 -0500

> not definite and/or can be altered at the whim of the patent holder.

There must at the very least be an audit trail and diffs for each
change, otherwise an implementor might think they're not infringing on
the basis of having read a version of an IPR disclosure that is later
changed, and how would they prove this in court?

Nico
--

---

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 23 Jul 2009 15:26:51 -0700

Dean and all,

  Good suggestion, but one that should have been obvious to the
IETF long ago.  Better late than never I suppose though...  BTW,
who's representing the IETF these days?  I am afraid I haven't kept
as current on that as well as I should have...

Dean Anderson wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

Regards,

Spokesman for INEGroup LLA. - (Over 284k members/stakeholders strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln
"YES WE CAN!"  Barack ( Berry ) Obama

"Credit should go with the performance of duty and not with what is
very often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS.
div. of Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail
[email-masked]
My Phone: 214-244-4827

---

From: Todd Glassey <[email-masked]>
Date: Thu, 23 Jul 2009 12:48:41 -0700

> changed, and how would they prove this in court?
Nico the real issue is the liability profile this opens for the IETF and 
its a nasty one IMHO.

Todd Glassey

---

From: Martin Rex <[email-masked]>
Date: Thu, 23 Jul 2009 23:34:16 +0200 (MEST)

> which it seems to have just admitted doing.

The IETF is NOT asking for an irrevocable "Grant" in an IPR disclosure.

The problem here is that submitting an URL for the real IPR disclosure
in the IETF disclosure form is subverting to idea that the IETF
can archive the IPR disclosures in their original form.

> not definite and/or can be altered at the whim of the patent holder.

Copyright terms stick to the published text or code when they're
published (under the condition they're rightfully issued).

AFAIK, License grants for patents are rarely issued as "irrevocable",
which means that the terms can be cancelled/terminated.

-Martin

---

From: Dean Anderson <[email-masked]>
Date: Thu, 23 Jul 2009 18:40:32 -0400 (EDT)

> The IETF is NOT asking for an irrevocable "Grant" in an IPR disclosure.

Of course not.  The IETF just wants to know what the terms are. We take
those terms into consideration in our decision to approve or reject the
document.

But if the terms of license are variable or indefinite, then there
really are no terms. The patented technology is not free and we don't
have any idea what it will cost--it will probably be expensive.  We
often reject such documents as being unfavorable.

> can archive the IPR disclosures in their original form.

I agree

> published (under the condition they're rightfully issued).

I don't know what copyrights have to do with anything, here. They have
nothing to do with what I said.  

My point above is that the disclosures required by RFC 3979 enable us to
make informed decisions regarding the patent-encumbered document, which
includes any licensing terms.  If a patent-holder offers unspecific or
variable terms that it can change them at whim, that fact by itself is a
good reason to reject the document.

> which means that the terms can be cancelled/terminated.

Well, actually, just the opposite is true. Rarely do patent licenses
have terms of revocation.  Most commercial patent holders just want the
money and don't care what you do after that. But free universal licenses
usually contain revocation terms that revoke the license if you use a
patent non-defensively. But at present, those licenses are
(unfortunately) the exception, not the rule.

In any case, if the license is revocable, one has to state the
conditions on which the licence can be revoked.  We can consider the
license terms in our decision, and I think we should reject documents
where the patent holder can subsequently refuse licenses in the future,
or alter the terms at its whim. Such patents can be expected to be
expensive in the future when the patent is part of a standard, and users 
have no choice but to pay whatever is demanded.

		--Dean

---

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 23 Jul 2009 17:48:55 -0700

Martin and all,

  Right!  Getting a license grant that is NOT "irrevocable",
is of VERY questionable value.  Same is true of a patent
grant to use.  If I am paying for either, it is either "irrevocable"
or no deal.  Simple as that.  If I am no paying for it than I want
at least a time limit before the terms can be modified in any
way.  Otherwise anything else is of VERY questionable value.

Regards,