[TLS] New IETF LC: draft-housley-tls-authz

[EKR <[e-mail]>]

<chair hat on>

The TLS WG should be aware of the following events regarding
draft-ietf-tls-authz. Because this is a TLS-related document
but not a WG item, there will be no call for input on the TLS
mailing list. I encourage WG members to send in their 
comments on the IETF mailing list.

-Ekr


--------------------------------------------------------------------
On June 27, 2006, the IESG approved "Transport Layer Security (TLS)
Authorization Extensions," (draft-housley-tls-authz-extns) as a
proposed standard. On November 29, 2006, Redphone Security (with whom
Mark Brown, a co-author of the draft is affiliated) filed IETF IPR
disclosure 767. The disclosure can be found at
https://datatracker.ietf.org/public/ipr_detail_show.cgi?&ipr_id=767 .
The disclosure may cover technology in draft-housley-tls-authz-extns
and other drafts. The claimed IPR relates to a US patent application
filed September 23, 2005. The claims of this application are now
public so IETF participants may examine the claims.


According to section 3.2.1 of RFC 3979, "The Contributor represents
that he or she has made or will promptly make all disclosures required
by Section 6.1.1 of this document."
Section 6.1.1 requires:

Any Contributor who reasonably and personally knows of IPR meeting
the conditions of Section 6.6 which the Contributor believes Covers
or may ultimately Cover his or her Contribution, or which the
Contributor reasonably and personally knows his or her employer or
sponsor may assert against Implementing Technologies based on such
Contribution, must make a disclosure in accordance with this Section
6.

The IESG has been informed by Mark Brown that he had knowledge of the
September 2005 patent application filed by his employer at the time he
submitted draft-housley-tls-authz-extns. Accordingly, he was
obligated to disclose the existence of this patent application upon
making this submission. Making a required IPR disclosure after a
draft is approved does not meet the requirement to promptly make the
disclosure. According to section 7 of RFC 3979 failure to make a
required disclosure is a failure of process. It should be noted that
the above disclosure obligations apply to unpublished patent
applications. When a patent application that is required to be
disclosed is unpublished, the discloser must 'indicate that the claim
is based on unpublished patent applications', but is not required to
list the application number (see RFC 3978 Section 6.4.1).

the IESG withdraws its approval of draft-housley-tls-authz-extns. The
RFC editor is hereby requested to remove this draft from their
publication queue. IANA is hereby requested to remove the assignments
for this draft and mark the codepoints as reserved. Should this draft
be approved in the future, IANA is requested to re-assign the same
codepoints.

The IESG is considering re-approving this draft with knowledge of the
IPR disclosure from Redphone Security. The IESG solicits final
comments on whether the IETF community has consensus to publish
draft-housley-tls-authz-extns as a proposed standard given the IPR
claimed. Comments can be sent to [e-mail] or exceptionally to
[e-mail]. Comments should be sent by 2007-03-13.

_______________________________________________
IETF-Announce mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/ietf-announce

-----------------------------------------------------------------------

_______________________________________________
TLS mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tls