Re: [TLS] 3GPP forbids support of MD5, SHA-1, non-AEAD, and non-PFS in TLS

[Tony Rutkowski <[e-mail]>]

Hi John,

There are several orders associated with the settlement agreement - 
which is relevant here.  You need a PACER account to access the docket.  
It was a complicated case that stretched over several years and cost 
ETSI a considerable amount of money - and involved several companies.  
Trueposition in its complaint alleged that the 3GPP SA standards were 
being manipulated through a conspiracy among the named parties to 
exclude Trueposition from the marketplace.  The other parties must have 
incurred similar or greater expenses.  The case reshaped the antitrust 
environment for standards setting bodies.  See 
http://sullivanlaw.net/standard-setting-org-may-be-liable-for-antitrust-violations-of-member-leaders/.

When the IETF role shifted from government/academic to public markets in 
the early 90s, the antitrust exposure increased significantly and the 
Internet Society purchased insurance to cover those in the IETF decision 
making process.  Presumably, that still exists.  Circa 2012, the IETF 
briefly visited the subject of antitrust culpability with a group that 
exchanged some email and hosted a BOF and then went quiet.  See 
https://datatracker.ietf.org/wg/antitrust/about/

The Trueposition v. Ericsson case occurred after that point and was 
ground breaking.  Antitrust law in this arena continues to evolve. Even 
individuals can be held accountable.  Over the past year, the 
competition enforcement bodies on both sides of the Atlantic have made 
it clear they are concerned about anti-competitive actions in the 
internet sector and have established investigatory task forces.

TLS is particular has a history going back to 1986 when the platform was 
first announced by the USG and the TLS specification was instantiated 
initially in the GOSIP standards and then in ITU/ISO standards.  The are 
many TLS variants and platforms that produce revenue in the marketplace 
and bring competition to the industry. It seems best to avoid increased 
antitrust exposure by potentially restraining TLS competition via 
standards body activities and suggesting that certain platforms are 
"mandates."

--tony


On 2020-03-07 9:23 PM, John Levine wrote:
> In article <[e-mail]> you write:
>> -=-=-=-=-=-
>>
>> One comment.  Perhaps some caution might be advised in light of the
>> antitrust court order in /Trueposition v. Ericsson/. Ref. Order in Case
>> No. 2:11-cv-4574, (U.S. E.D. Pa, 14 Jul 2014).
> That's a single page dismissing 3GPP from the case. Really?
>
> https://ia800306.us.archive.org/15/items/gov.uscourts.paed.426719/gov.uscourts.paed.426719.296.0.pdf
>
> R's,
> John
>
>