Subject: RE: [TLS] Re: I-D ACTION:draft-ietf-tls-srp-13.txt

From: "Blumenthal, Uri" <[email-masked]>
Date: Sat, 23 Dec 2006 21:28:01 -0500

>> I've heard that other parties claim that their patents cover SRP
>> method as well. Stanford license agreement pretty much says "yeah
>> those claims may be true - and if so it's your problem". (Caveat:
>> I'm not a lawyer - the above is how I understand the written text.
>> Feel free to correct me and provide the right interpretation.)
>
> AFAIK it's standard boilerplate.

This doesn't say anything about the correctness (or the lack)of my 
interpretation. I care not whether it is a standard boilerplate or 
not - rather whether I interpreted it correctly.

>> In short - I'd like to see some evidence that political/legal/IPR
>> problems indeed have been solved (which is harder than writing an
>> implementation :-).
>
> Under the current circumstances, the growing base of running code
> for TLS/SRP and the rough consensus among its implementors is
> the best evidence one could reasonably expect. 

Speaking of political/legal/IPR issues - freeware is not a good 
enough evidence for me, sorry. Recall RSA and PGP (wide spread 
of PGP wasn't a proof that RSA technology was free).

> If SRP weren't truly free, it would be in the same boat as
> the other ZKP protocols 

I agree that SRP has better chances (and its authors & patent holders 
did give it to Public Domain, which is definitely nice) - but I 
personally am afraid that its legal chances are not good enough. 
So far I haven't seen evidence to the contrary. 
I'd be happy to observe some! 
Freeware available for download doesn't quite cut it (it proves that 
the technology works, and that people like it enoiugh to invest their 
time and efforts into it - but not its legal standing).

> ...........and would not have attracted the
> interest level it has, especially with OSS projects.

To disprove this point - can you think back a decade and say "PGP"? :-)

Regards,
Uri
<Disclaimer> I speak for myself only

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Tom Wu <[email-masked]>
Date: Tue, 26 Dec 2006 00:24:37 -0800 (PST)

> not - rather whether I interpreted it correctly.

Since it's boilerplate, Stanford isn't responding to any third party
claims, as your interpretation implies, simply stating standard terms
for a royalty-free license.

> of PGP wasn't a proof that RSA technology was free).

Yes it was, in the sense that it was possible to use PGP legally
as long as you conformed to the RSA licensing terms.  MIT PGP
(in the US) was legal with RSAREF and the international
version used PRZ's own library.  SRP is likewise legal if you
stay within its licensing terms, which do not place any restrictions
on which specific implementation is used.

> To disprove this point - can you think back a decade and say "PGP"? :-)

Your example actually affirms my point nicely.

> <Disclaimer> I speak for myself only

Tom
-- 
Tom Wu
http://www-cs-students.stanford.edu/~tjw/