Re: [Cfrg] New Version Notification for draft-whyte-select-pkc-qsh-00.txt

[Simon Josefsson <[e-mail]>]

> Simon, I'm not sure I understand. 
> 
> For the sake of the argument, assume company A allows free use of
> their patented algorithm B in TLS. ‎OpenSSL project notifies A that
> it's about to include B in the codebase. In which case A can answer
> "Go ahead", "No way", or "Pay us". In the two latter cases, the
> algorithm simply won't end up included. Ideally, this exchange
> happens before the TLS WG standardizes/accepts B. 

This raises several questions:

1) What do you mean by "free use"?  If it is really free use, there is
no need to ask for permission, and there is no way for the company to
say "no way" or "pay us".

2) If the "in TLS" part is a crucial part of there patent licensing, it
may matter how the integration works.  Is the algorithm usable without
TLS or not?

3) In practice having this dialogue is difficult.  NDAs is usually a
non-starter for a FOSS project.  For example, I tried having a
discussion with RedPhone for the TLS Authorization extension that I
implemented in GnuTLS and that fell apart.  Often the company benefits
from having projects being in the dark about whether they are allowed
to use the technology or not (FUD tactic).

/Simon

> 
> Sent from my BlackBerry 10 smartphone on the
> Verizon Wireless 4G LTE network. Original Message  
> From: Simon Josefsson
> Sent: Tuesday, September 22, 2015 03:55
> To: Peter Gutmann
> Cc: Blumenthal, Uri - 0553 - MITLL; CFRG
> Subject: Re: New Version Notification for
> draft-whyte-select-pkc-qsh-00.txt
> 
> Peter Gutmann <[e-mail]> writes:
> 
> > Simon Josefsson <[e-mail]> writes:
> >
> >>That is not consistent with my view or experience. If you publish a
> >>library that implements a patented algorithm, and your library is
> >>popular enough to attract attention from the patent holder, you
> >>will have a hard time.
> >
> > Only if you're using someone else's patented algorithm
> > inappropriately. My code had IDEA (for PGP 2.x support) in it, I
> > included Ascom Tech's patent statement in the docs as they
> > requested giving the T&C under which it could be used, and sent
> > them a courtesy note about it. I got a reply from them that said
> > something like "thanks for the note, and all the best with your
> > work". So provided you play by the rules (whether you agree with
> > them or not), things should be OK.
> 
> They realized they couldn't charge you, and that having IDEA in your
> product would allow them to charge others. Others ended up paying for
> IDEA, or refused to work with it (like libgcrypt). This is what I
> refer to by "having a hard time".
> 
> Going back to the original topic: I don't think what you are
> describing is a workable approach for a general patent rule when
> considering which algorithms to consider here.
> 
> /Simon
>