Re: [Cfrg] [secdir] ISE seeks help with some crypto drafts

[Tony Arcieri <[e-mail]>]

On Fri, Mar 8, 2019 at 11:15 AM Stephen Farrell <[e-mail]>
wrote:

>
> FWIW, I'd prefer have fewer and not more modes of operation
> documented. I'm not aware of a need for what this draft
> appears to specify (based on reading just the abstract). I
> also agree the OCB IPR situation isn't clear (IIRC more than
> just Rogaway's IPR was involved).
>

Rogaway has a pretty detailed description of the IPR situation on the OCB
site:

http://web.cs.ucdavis.edu/~rogaway/ocb/ocb-back.htm

— snip —
Does Phil have a patent on OCB? Yes, I did file patent applications
covering the new techniques used in OCB. There was a filing on 12 October
2000, and a filing on 9 February 2001. If you want to use OCB in a
commercial product, you'll need to get a license from me. But I'll license
this IP under fair, reasonable, and non-discriminatory terms. All companies
will be offered the same license agreement. I expect licensees to pay a
modest, one-time fee.

Here is a patent-assurance letter
<http://web.cs.ucdavis.edu/~rogaway/ocb/ieee.pdf> I wrote for the IEEE,
which mandates OCB in a *draft*802.11 (Wireless LAN) standard, as part of
the WEP ("Wired Equivalent Privacy") protocol.
How much will a license cost? Not much. I intend that no solvent company
should find licensing from me to be a significant issue in their cost of
doing business. Here is an offer letter
<http://web.cs.ucdavis.edu/~rogaway/ocb/offer.pdf> indicating how I am
licensing OCB.Has OCB already been licensed? Yes, it has. But,
unfortunately, I am not at liberty to say more.Will anyone else come to
have a valid patent that covers OCB? Unfortunately, this question is
impossible to answer at this point. IBM has indicated that it has a patent
filing that covers Jutla's authenticated-encryption work. They indicate
that this was filed on 14 April 2000. Gligor has indicated that he has
three patent filings that cover his authenticated-encryption and
parallelizable MAC work. He indicates that these were filed on 31 January
2000, 31 March 2000, and 24 August 2000. All of these filings were
provisional patent filings.

One can only conjecture who will have what enforceable rights. As for
Jutla/IBM, I have been clear all along that OCB retains similarities to
Jutla's IAPM. Intellectually, OCB owes much to Jutla's work. But whether or
not IBM's patent covers OCB may depend on how broadly IBM's claims were
crafted.

As for Gligor/VDG, I am unaware of any idea from [Gligor, Donescu; 18
August 2000] that I used in OCB. I believe that any utility patent filed
after Jutla's work and my work appeared but based on a provisional patent
filed before Jutla's work and my work appeared will need to be examined
with care, comparing the contents of the utility patent to the contents of
the provisional patent, and paying attention to what was published in the
interval. Such an exercise is currently impossible, because provisional
patents are not made available before utility patents issue.

I start to think that I have been too talkative and too concerned about
what IP other parties could come to hold. In truth, nobody ever knows the
answer to this question.
-- 
Tony Arcieri