Re: [IPsec] New criteria draft

[Yaron Sheffer <[e-mail]>]

Hi Dan,



thanks for your comments. Please see my response inline.



   Yaron

________________________________________
From: Dan Harkins [[e-mail]]
Sent: Thursday, March 11, 2010 7:35 PM
To: Yaron Sheffer
Cc: [e-mail]
Subject: Re: [IPsec] New criteria draft

  Hi Yaron,

  One comment you might've missed was this:

     Also, the table in section 5 should include IEEE 802.11s under the
     "standards" column for SPSK. And the phrase "may or may not infringe
     on existing patents" applies to all candidates, and frankly, to
     almost everything in the IETF. It is a meaningless phrase and it
     would be better to just remove it from the "IPR" column.

That comment also received a "+1" from another commenter on the list.

<YS>

In fact, I did not miss these two comments. I did not list 802.11s because I prefer to list only standards that are primarily vetted by the security community. Hence the "Securty Standards" column in -01.



Regarding the second comment, while in principle I agree that it could apply to anything done at the IETF, unfortunately in our case it does apply. It applies because of two reasons:

- Spurious (whether legitimate or not, I cannot say) IPR statements made agaist SRP.

- The sheer amount of patents in this area that must be analysed to ensure, with a high level of confidence, that you will not be sued for implementing X.



And I disagree with your statement below, "It is not our job to prove that no patents apply to some technology." As individuals, and for many of us, as employees, it is our job to ensure ourselves that we (or our company) will not be getting into legal/financial trouble by making this choice.



And I don't think this is "proving a negative". We can think of a process to get this level of confidence. But just shouting at one another will not get us there. Please see http://tools.ietf.org/html/draft-mcgrew-fundamental-ecc-01 for a creative approach to deal with IPR in another, somewhat related, contentious area.



Having said that, if you read -01 carefully, you will see that I'd rather focus our energies on discussing the security aspects rather than endlessly discussing IPR.



And by the way, which protocol are you referring to in the last paragraph?

</YS>

  Also, I think this takes us down a particularly bad path:

   o  Ideally, the proposal should be unencumbered.  This property is
      very difficult to prove, and each WG participant should attempt to
      review the applicable patents and determine whether in fact they
      do not apply to the proposal.  Remember that independently
      invented technology might still infringe a patent.
   o  In some cases the IPR situation is clear: if the protocol relies
      on a specific patent, and believed to not require the use of any
      other.  This is mostly useful if the patent's licensing terms
      (whether free or not) are known, and/or the patent's expiration
      date is near.

  So while we start off our criteria grandly with "it should be
unencumbered" we immediately then dismiss that by saying we can't forget
it might still be patented by some unknown patent. So "ideally" is just
one of those states we cannot achieve because even if it's "unencumbered"
it might not be. So that's off, what's next? If the IPR situation is clear,
it relies on a specific patent and the patent's expiration date is near.
So I guess we're just supposed to stop here, right?

  It is unwise for anyone to say what another IP holder will say
with respect to his or her IPR. And there might be a patent that covers
everything done in the IETF, we just don't know and it's not our job to
prove a negative. So I think it would be very unfortunate if the discussion
of candidates jumped down this rathole. We would have "I'm not a lawyer
but..." followed by a contentious statement and 8 people jumping up to
the queue on the mic to precede their comments with "I'm not a lawyer
but..." and then make other contentious statements.

  I think the IPR content in this draft should be as simple as possible:

    o We live in a litigious world and patents are used as both a club
      and a shield.
    o Patents might or might not exist on every technology we discuss.
    o We should not attempt to prove or disprove whether this or that
      patent might or might not cover some technology.
    o It is not our job to prove that no patents apply to some technology.

  It would be great to choose a technology that does not require any
licensing but as we've seen in the last couple days even the most
straightforward and innocent of protocols that we choose to adopt can
still be encumbered.

  regards,

  Dan.

On Thu, March 11, 2010 1:17 am, Yaron Sheffer wrote:
> Hi,
>
> Based on mailing list comments, I have posted a revision of
> draft-sheffer-ipsecme-pake-criteria here:
> http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs. I will submit it
> as usual when the submission window reopens.
>
> Thanks,
>      Yaron
> _______________________________________________
> IPsec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ipsec
>



Scanned by Check Point Total Security Gateway.