Subject: RE: [TLS] Re: I-D ACTION:draft-ietf-tls-srp-13.txt

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 21 Dec 2006 15:31:43 -0500

I for one would like to (a) see the URLs pointing to free reference implementation(s), and (b) hear a clarification wrt. IPR status of the method defined in this draft.

I would certainly object advancement beyond Experimental until these two questions are answered to the satisfaction of the WG.

Regards,
Uri
<Disclaimer> I speak for myself only.

-----Original Message-----
From: Peter Sylvester [mailto:[email-masked]] 
Sent: Thursday, December 21, 2006 12:11 PM
To: EKR
Cc: [email-masked]
Subject: Re: [TLS] Re: I-D ACTION:draft-ietf-tls-srp-13.txt

EKR wrote:
> Peter Sylvester <[email-masked]> writes:
>   
>> Would you mind giving a little bit more detailed explanation in particular
>> what are the reasons why this cannot be on standards tracks, or what would
>> be necessary if it would be etc.
>>     
>
> There are two reasons. First, as a matter of policy we are attempting
> to move new work to Standards Track only where there is fairly strong
> support for the work. In this case, the support for this work did
> not appear to be particularly strong.
>   
Several existing interoperable implementations exist. I think that this is
perfectly in the spirit of the IETF. If accepted as a standards track, 
the protocol
would probably directly directly go to draft.
> Second, the IPR issues surrounding all the ZKPP protocols are quite
> murky and thus it would have required an affirmative decision by
> the WG to move this document forward as a Proposed Standard
> despite said issues. 
>   
Several have requested the document being forwarded.
I have not read any comment so far that is against the proposal except may
you in this comment.

-- 
To verify the signature, see http://edelpki.edelweb.fr/ 
Cela vous permet de charger le certificat de l'autorité; 
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch. 

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Tom Wu <[email-masked]>
Date: Thu, 21 Dec 2006 18:55:51 -0800 (PST)

> I for one would like to (a) see the URLs pointing to free reference implementation(s), and (b) hear a clarification wrt. IPR status of the method defined in this draft.

(a) I am aware of the following free implementations of TLS/SRP:

- http://www.edelweb.fr/EdelKey/ (OpenSSL, C-based)
- http://www.trevp.net/tlslite/ (Python-based)
- http://www.gnu.org/software/gnutls/ (C-based, GPL)
- http://www.nongnu.org/jessie/ (Java-based)

(b) SRP-6 as used in the TLS/SRP specification is available under
Stanford's royalty-free licensing terms
(http://otl.stanford.edu/pdf/97006.pdf).

> <Disclaimer> I speak for myself only.

Tom

-- 
Tom Wu
http://www-cs-students.stanford.edu/~tjw/

---

From: Casey Marshall <[email-masked]>
Date: Thu, 21 Dec 2006 19:26:19 -0800

On Dec 21, 2006, at 6:55 PM, Tom Wu wrote:

>> I for one would like to (a) see the URLs pointing to free  
>> reference implementation(s), and (b) hear a clarification wrt. IPR  
>> status of the method defined in this draft.
>

Jessie was written using an early draft of the spec, and (at least)  
the cipher suite IDs have changed in the interim (to, I believe, some  
values that are yet-to-be-defined for real, unless "TBD" has some  
value, or other implementations are using placeholder values).

We have not maintained the SRP support in this code, which is now a  
part of GNU Classpath <http://www.gnu.org/software/classpath/>

Cheers.