Re: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00

[Jon Callas <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Feb 11, 2013, at 8:33 AM, "Blumenthal, Uri - 0558 - MITLL" <[e-mail]> wrote:

> * PGP - S/MIME Signed by an unverified key: 02/11/2013 at 08:33:04 AM
> 
> On 2/11/13 11:20 , "Ted Krovetz" <[e-mail]> wrote:
> 
> 
>>> "No Discrimination Against Fields of Endeavor"
>> 
>> License 1 has no such restriction. Only License 2 does. Since you are
>> free to choose which license you wish to abide by, I don't see any reason
>> you couldn't use OCB under License 1 in your work.
> 
> I'd still like to see clarifications (answers to my example questions)
> regarding License 1. To make it easier to track, here it is:
> 
> Let's consider (an updated) hypothetical case: company A adds an OCB
> implementation
> to OpenSSL (or Crypto++). Company X then uses that library/package in their
> proprietary "SuperComm" software that they subsequently sell to Department
> of Defense and to Department of Energy.
> 
> First - are they even allowed to to that under this license?
> 
> Second - how much of the source code do they have to make available to
> satisfy the terms of "License 1"? Just the OCB code? The entire OpenSSL or
> Crypto++? The entire "SuperComm" source?
> 
> 
> Third - if there's a violation of the license terms in the above example,
> which entity is considered responsible?

But that's A Corp's problem, not the IETF's. It's the purpose of a standard to describe things for the purposes of interoperability. Arguably, it's also a layer 8 problem and we're layer 9.

A Corp can very likely make the problem go away by throwing cash at the problem, as well. At PGP, we liked EME2, another Rogaway protocol with similar IP issues. We bought a license from the University of California. It was reasonably priced. We got on with our lives.

	Jon


-----BEGIN PGP SIGNATURE-----
Version: PGP Universal 3.2.0 (Build 1672)
Charset: us-ascii

wj8DBQFRGR9DsTedWZOD3gYRAn0sAKCcqhcd8MFSMI9uZfOKvWbEtIMNUwCg/6Ib
+w/E1gvp4T4I0XS/qDOSlE8=
=+wE8
-----END PGP SIGNATURE-----