Subject: Re: [TLS] Document Action: 'TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode' to Informational RFC

From: Dean Anderson <[email-masked]>
Date: Wed, 25 Jun 2008 18:11:58 -0400 (EDT)

On Wed, 25 Jun 2008, Russ Housley wrote:

> Dean:
> 
> >If I understand correctly, Certicom has over 130 patents in ECC and
> >public key crypto and has sold 26 patents and patent applications on the
> >subject to the US National Security Agency. The NSA controls licening
> >rights on those patents, not Certicom. The licensing situation is much
> >more clouded by that sale.
> 
> You do not understand correctly. NSA and Certicom gave briefings at 
> the SAAG session at the last IETF meeting held in Washington, 
> DC.  The slides and other information from that session are in the proceedings.

Thanks. It appears my only misconception was thinking that Certicom sold
the patents outright---it did not. Rather, it sold the _licensing_
rights to 26 patents to the NSA.

However, this misconception is hardly relevant to the concerns I raised.  

Indeed, it appears to be the case that I was correct on the principle
issue:  That the general public is not licenced to use these patents on
implementing this draft.

> http://www.ietf.org/proceedings/04nov/slides/saag-2/sld1.htm

The above presentation doesn't give the general public or the IETF the
right to use the patents. The presentation just reviews the NSA's rights
to licence the patents, and explains how to get an NSA license.  The
presentation seems to suggest that only USG purposes (as opposed to
private commercial) will be granted by the NSA. This may seem kind of
odd, since the USG can always use patents---you can't sue the US
government for infringement.  Of course, the NSA also wants to give the
technology to foreign governments, which would be covered by a US
Patent, so the NSA purchase does make sense.  Nowhere in the
presentation does it say that anyone who asks will be granted a license.

As slide 5 shows, licensing is for a NSA-approved products and those are
defined as being products for use by "Federal, State or Local government
agencis protecting classified or mission critical national security
information, or" [next slide] "-Foreign government agencies..."  That
doesn't seem to cover the IETF or the general public.

> http://www.ietf.org/proceedings/04nov/slides/saag-5.pdf

The above identifies the 26 patents the NSA can licence. Thanks.

> http://www.ietf.org/proceedings/04nov/slides/saag-4/sld1.htm

The above presentation just covers software that Certicom will give to
NSA users, not to the general public.

	--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: "Whyte, William" <[email-masked]>
Date: Wed, 25 Jun 2008 19:00:12 -0400

NSA has the right to sub-license. Certicom retains the rights to license
the patents. 

William

---

From: Russ Housley <[email-masked]>
Date: Fri, 27 Jun 2008 11:00:03 -0400

>rights to 26 patents to the NSA.

It is a nonexclusive relationship.  That is important too.

>issue:  That the general public is not licenced to use these patents on

Right.  This is the reason the document is a candidate for the 
standards track.  The idea of the informational specification is so 
that anyone that chooses to use this technology can do so in an 
interoperable way.

Russ