Re: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

>>practically unusable in any serious product (commercial or otherwise)
>>because of its licensing terms.
>
>I certainly hope that we can convince you that this is not true.

I'd love to be convinced, as (contrary to how it may appear) I'm not
averse to faster AEAD modes. :)

>There are a huge number of serious open-source products that all fall
>under License 1's simple terms (linux, gnu, any project using any
>OSI-approved license, etc).
>
>Note that License 1 does not have a non-military provision, meaning that
>open-source software need not worry about it.

Let's consider a hypothetical case: a company X adds an OCB implementation
to OpenSSL (or Crypto++) and then use that library/package in their
proprietary "SuperComm" software thatthey subsequently sell to Department
of Defense and to Department of Energy.

First - are they even allowed to to that under this license?

Second - how much of the source code do they have to make available to
satisfy the terms of "License 1"? Just the OCB code? The entire OpenSSL or
Crypto++? The entire "SuperComm" source?

>And we are determined try to make License 2 workable, which would then
>make all software (open or closed, commercial or non-commercial) free for
>non-military use, and hardware implementations free for non-commercial
>non-military purposes.

Non-commercial hardware? I'd like to see an example of that, and maybe a
box of samples. :)