Re: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

License 1 is Open Source, and A may not be a Corp (like PGP, Inc. is). And
if (for example) I were to develop and release some free code - I sure
wouldn't want to throw cash at this problem.
--
Regards,
Uri Blumenthal
<Disclaimer>




On 2/11/13 11:41 , "Jon Callas" <[e-mail]> wrote:

>
>On Feb 11, 2013, at 8:33 AM, "Blumenthal, Uri - 0558 - MITLL"
><[e-mail]> wrote:
>
>> * PGP - S/MIME Signed by an unverified key: 02/11/2013 at 08:33:04 AM
>> 
>> On 2/11/13 11:20 , "Ted Krovetz" <[e-mail]> wrote:
>> 
>> 
>>>> "No Discrimination Against Fields of Endeavor"
>>> 
>>> License 1 has no such restriction. Only License 2 does. Since you are
>>> free to choose which license you wish to abide by, I don't see any
>>>reason
>>> you couldn't use OCB under License 1 in your work.
>> 
>> I'd still like to see clarifications (answers to my example questions)
>> regarding License 1. To make it easier to track, here it is:
>> 
>> Let's consider (an updated) hypothetical case: company A adds an OCB
>> implementation
>> to OpenSSL (or Crypto++). Company X then uses that library/package in
>>their
>> proprietary "SuperComm" software that they subsequently sell to
>>Department
>> of Defense and to Department of Energy.
>> 
>> First - are they even allowed to to that under this license?
>> 
>> Second - how much of the source code do they have to make available to
>> satisfy the terms of "License 1"? Just the OCB code? The entire OpenSSL
>>or
>> Crypto++? The entire "SuperComm" source?
>> 
>> 
>> Third - if there's a violation of the license terms in the above
>>example,
>> which entity is considered responsible?
>
>But that's A Corp's problem, not the IETF's. It's the purpose of a
>standard to describe things for the purposes of interoperability.
>Arguably, it's also a layer 8 problem and we're layer 9.
>
>A Corp can very likely make the problem go away by throwing cash at the
>problem, as well. At PGP, we liked EME2, another Rogaway protocol with
>similar IP issues. We bought a license from the University of California.
>It was reasonably priced. We got on with our lives.
>
>	Jon
>