Re: [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exporters for Transport Layer Security (TLS)) to Proposed Standard

[Richard Stallman <[e-mail]>]

	> Generally speaking, standards are useful, because they enable people to
	> converge what they are doing. But that ceases to be true when the use of
	> the standard is patented. It is better to have no standard than have a
	> standard that invites people into danger.

    But for any standard, there might be a 'submarine' patent (i.e. one not
    declared to the IETF, which will be sprung once use of the standard is
    widespread). That standard will have "invite[d] people into danger".

That argument seems to be based on the general premise that "Since we
can never be perfectly safe, we should ignore even obvious risks."

    Or if I don't like a particular proposed standard, I can say 'hey, I have this
    patent, and I claim it applies'.

In theory yes, but it seems unlikely that anyone wants to do this.
We should not ignore a real danger to avoid an imaginary one.

    So what's the answer - no standards at all? Of course not, we take a
    calculated risk, based on an intuitive cost-benefit analysis, and do the
    standards.

In this case we see a real and specific threat, and we can live
without the standard just fine.

    (And sometimes the benefits of an encumbered standard are actually worth the
    costs. Case in point, the standards which used RSA public-private keysystems.)

Since the patents mostly prevented the use of RSA, there was no room
for the standards to do any good, or much harm.