Re: [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exporters for Transport Layer Security (TLS)) to Proposed Standard

[Dean Anderson <[e-mail]>]

Hi Eric,

On Tue, 21 Jul 2009, Eric Rescorla wrote:

> As others have stated, Certicom's has a variety of patents that
> apply to ECC technology. When TLS Extractor (or indeed any other
> IETF technology) is used with the TLS ECC cipher suites, then
> there is a potential issue with regard to Certicom's patents,
> but that issue is produced not by Extractor, but by the use
> of ECC. After Certicom's disclosure (1004), there were
> questions about whether Certicom's IPR also applied to Extractor
> with non-ECC cipher suites.

Err, no. See the message on the misuse of patents.  IF* there is no
patent claim to cover extractor, adding extractor would raise the issue
of misuse for trying to cover extractor with its patent licence.  IF*
there is a claim or claims covering extractor, we cannot be sure they
are limited to use with ECC.  The test for infringement is when the use
performs "substantially the same function" as claimed.  It would seem
that anything that is similar to ECC, (but not ECC) probably performs
substantially the same function with respect to extractor claims.

[* Again, more exact statements cannot be made because Certicom has been
unhelpful in identifying the precise patent(s) and claims that cover
extractor.]

>     It is our intention to foster broad adoption of ECC technology.  The
>     grant is meant to cover any necessary Certicom patents and patent
>     applications to implement RFC 4492, RFC 5289 or the
>     draft-rescorla-tls-suiteb when used with draft-ietf-tls-extractor.  It
>     is not making any statement to the draft-ietf-tls-extractor when used
>     absent of these three cipher suites.
> 
> You can find the new disclosure at: https://datatracker.ietf.org/ipr/1153/.

Then they updated that with IPR 1154. While necessary updates of
details, I find no differences that significantly alter the key facts:

1. The Certicom disclosures state that Extractor is covered by a patent.

2. There is no universal free license. There is only the offer to 
request a free license. Certicom can refuse requests at anytime.

3. Certificate Authorities are already denied any free licence.

The statement you quote above doesn't alter anything, and I am mystified
why people continue to cite that statement as evidence of "good intent"
or that this is free software. It is not free software. Obviously,
_every_ proprietary software vendor's intention is to 'foster broad
adoption' of their technology. They often give out free samples to do
that.  And of course, they then extract as much money for that software
as they can;  the software doesn't remain free.  Certicom's stated
intent is to foster broad adoption, not produce free software.

But the Certicom statement is still slightly misleading because there is
no actual grant made in the document, even though the document refers to
"the grant".  The document states only that one may _request_ a free
license. But one doesn't need a 'grant' to request free licence. Anyone
can _ask_ Oracle, MS, etc for a free license too---Maybe that request
will be granted.  And BTW, I have no doubt that Certicom will give out
_some_ free licenses to encourage adoption---I'm not accusing them of
outright deception.  But proprietary vendors like Oracle also give out
free samples.  The difference is that free software is inherently free,
and proprietary software is free for a limited time.  Don't be fooled by
the limited offer.

>    Section V of the form, "Disclosure of Patent Information (i.e.,
>    patents or patent applications required to be disclosed by Section 6
>    of RFC 3979)," has been updated.  Subsection C highlights the specific
>    RFCs and I-Ds that are believed to be covered by the patents and
>    patent applications listed in Schedule A of the linked IPR
>    contribution
>    (http://www.certicom.com/images/pdfs/certicom%20-ipr-contribution-to-ietfsept08.pdf).
>    Please note that no version of the draft_ietf_tls_extractor appears in
>    this section.
> 
> I consider this pair of statements combined with the IPR statement quite
> satisfactory. You of course are free to feel differently.

The Certicom statements are satisfactory only in the sense that Certicom
has met the minimum requirements for disclosure.  Once the disclosure
content is analyzed for their terms, I find the terms offered
unacceptable and recommend against approving the document.

But I think the process is not satisfactory because the Working Group
didn't discuss non-patented alternatives to extractor as mandated by RFC
3979.  If the WG did discuss non-patented alternatives, I missed that
discussion, and I would appreciate a pointer to the record.

		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000