Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Aaron Zauner <[e-mail]>]

Hi,

Paul Lambert wrote:
>> Hi TLS-WG,
>>
>> Over the last couple of days I've again looked into OCB, read the
>> original paper as well as quite some literature on it, patents, CFRG
>> discussion et cetera.
>>
>> OCB looks like an elegant and parallel mode for inclusion in TLS.
> Yes, OCB is a very nice AEAD.
> 
>> I've searched through recent TLS-WG discussion, OCB has been
>> mentioned in passing as has EAX(2). When first looking into that my
>> main concerns were:
>>
>>   * IPR/patents: the authors have granted access to OSI licensed
>>     software as well as to commercial (non military!) software for
>>     all use [0] [1].
> No - the IETF IPR database statement does reflect the claims in [1]
> https://datatracker.ietf.org/ipr/search/?submit=draft&id=draft-irtf-cfrg-oc
> b 
> 
> The problem with OCB, when first introduced as an option for
> 802.11i was that there were multiple claimed owners of the IPR.
> 
> This still seems to be the case.  Looking at the IETF IPR disclosures:
> 	#6,973,187 - Gligor & Donescu (VDG Inc)
> 	#6,963,976  #7,093,126 - Jutla (IBM)
> 	#7,046,802 #7,200,227 #7,949,129 #8321675 - Rogaway

Thanks for pointing this out.

FYI: CFRG members made some statements regarding different IPR (and
performance) issues in discussions [0] [1] [2]. Rogaway is pretty clear
on his own patents in [3].

This did not seem to stop adoption.

> This should not stop inclusion of OCB as an optional mode in TLS,
> but OCB is not clearly Œfree¹.

Sure. I agree. I'd still be nice to have it in there though.

Aaron

[0] https://www.ietf.org/mail-archive/web/cfrg/current/msg03300.html
[1] https://www.ietf.org/mail-archive/web/cfrg/current/msg03277.html
[2] https://www.ietf.org/mail-archive/web/cfrg/current/msg02989.html
[3] https://www.ietf.org/mail-archive/web/cfrg/current/msg03301.html