Subject: RE: [TLS] Re: I-D ACTION:draft-ietf-tls-srp-13.txt

From: "Blumenthal, Uri" <[email-masked]>
Date: Fri, 22 Dec 2006 09:11:57 -0500

>> .......I would think that the existence
>> of implementations, in several languages no less, and the support of
>> the associated implementors who have invested time/energy in solving
>> not just the technical problems but political/legal/IPR ones if
>> anything should carry more weight.
>
> Implementations are one indicator of support but they're not
> the only one.........

Reading the Stanford legal disclosure 
(http://otl.stanford.edu/pdf/97006.pdf) - while it was very 
nice of them to release THEIR patent to the public - I saw a big
disclaimer on page 2 section 4 Negation of Warranties, in 
particular 4.1. 

I've heard that other parties claim that their patents cover SRP 
method as well. Stanford license agreement pretty much says "yeah 
those claims may be true - and if so it's your problem". (Caveat: 
I'm not a lawyer - the above is how I understand the written text. 
Feel free to correct me and provide the right interpretation.) 
I understand that since Stanford doesn't charge for the license, 
one can't demand or expect much from them, but you must understand 
those who find such a license less than reassuring.

In short - I'd like to see some evidence that political/legal/IPR 
problems indeed have been solved (which is harder than writing an
implementation :-).

Regards,
Uri
<Disclaimer> I speak for myself only

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Tom Wu <[email-masked]>
Date: Fri, 22 Dec 2006 14:35:04 -0800 (PST)

> Feel free to correct me and provide the right interpretation.)

AFAIK it's standard boilerplate.

> problems indeed have been solved (which is harder than writing an

Under the current circumstances, the growing base of running code
for TLS/SRP and the rough consensus among its implementors is
the best evidence one could reasonably expect.  If SRP weren't
truly free, it would be in the same boat as the other ZKP protocols
and would not have attracted the interest level it has, especially
with OSS projects.

> <Disclaimer> I speak for myself only

Tom
-- 
Tom Wu
http://www-cs-students.stanford.edu/~tjw/