Subject: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00

From: "Igoe, Kevin M." <[email-masked]>
Date: Tue, 5 Feb 2013 15:08:05 +0000

We are issuing a RG Last Call on draft-irtf-cfrg-ocb-00.  This has been well evaluated
on the outside & no objections have been raised on the mailing list.  Please look
it over, paying particular attention to the IETF related usual issues such as intellectual
property rights.  It would be nice to have this finished before Orlando!

----------------+--------------------------------------------------
Kevin M. Igoe   | "We can't solve problems by using the same kind
[email-masked]  | of thinking we used when we created them."
                |              - Albert Einstein -
----------------+--------------------------------------------------

---

From: "Blumenthal, Uri - 0558 - MITLL" <[email-masked]>
Date: Tue, 5 Feb 2013 15:31:23 -0500

Perhaps I wasn't attentive enough  but I saw no reference to Intellectual
Property (IP) restrictions. OCB mode used to be patented and not free. Then
I've heard that the restrictions were relaxed so that a person could use it
free of charge unless the intended (?) purpose was military-related  which
would exclude Government employees and Government contractors.So regardless
of what the current restrictions are, IMHO they have to be spelled out
clearly, or at worst referred to in the References section (and it better be
"one hop"!).

Tnx!

P.S. My sotto voce  I'd love to see how OCB compares to GCM on the current
Intel chips that have GF and AES hardware speedups.
--
Regards,
Uri Blumenthal
<Disclaimer>

From:  <Igoe>, "Kevin M." <[email-masked]>
Date:  Tuesday, February 5, 2013 10:08
To:  "[email-masked]" <[email-masked]>
Cc:  'Phillip Rogaway' <[email-masked]>
Subject:  [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00

---

From: Ted Krovetz <[email-masked]>
Date: Tue, 5 Feb 2013 14:17:30 -0800

Phil has issued broad licenses for OCB, allowing open-source software implementations and software implementations in non-military contexts and non-commercial non-military hardware implementations. The licenses are at

  http://www.cs.ucdavis.edu/~rogaway/ocb/license.htm

It is my understanding -- correct me if I'm wrong -- that IP disclosures do not go directly in the RFC but instead get disclosed to the IETF along with the RFC submission. This has been done and the disclosures are at 

  https://datatracker.ietf.org/ipr/search/?option=document_search&id_document_tag=draft-krovetz-ocb

There is a study of OCB performance vs other AE schemes which includes AES-NI on Westmere hardware.

  http://www.cs.ucdavis.edu/~rogaway/ocb/ocb-doc.htm
  http://www.cs.ucdavis.edu/~rogaway/ocb/performance

These have not been updated for Sandy Bridge or Ivy Bridge. I can tell you that under Sandy Bridge OCB takes just 0.87 cycles per byte when processing 4KB messages. The fastest GHASH implementation I know about is Andy Polyakov's OpenSSL implementation that runs at 2.0 cycles per byte (just for GCM's hashing, you'd have to add the cost of encryption to get GCM's overall speed). Sandy Bridge and Ivy Bridge did not improve PCLMULQDQ performance but did improve AESENC performance, meaning that Sandy and Ivy improved OCB's performance much more than GCM's.

-Ted

---

From: "Blumenthal, Uri - 0558 - MITLL" <[email-masked]>
Date: Tue, 5 Feb 2013 17:44:12 -0500

Going to Phil's page gives the following. What is the relation between
"License 1" and "License 2"?

* License for Open-Source Software Implementations of OCB
<http://www.cs.ucdavis.edu/~rogaway/ocb/license1.pdf> (Jan 9, 2013) ‹
³License 1² 
Under this license, you are authorized to make, use, and distribute
open-source software implementations of OCB. This license terminates for
you if you sue someone over their open-source software implementation of
OCB claiming that you have a patent covering their implementation.
This is a non-binding summary of a legal document (the link above). The
parameters of the license are specified in the license document and that
document is controlling.

* General License for Non-Military Software Implementations OCB
<http://www.cs.ucdavis.edu/~rogaway/ocb/license2.pdf> (Jan 10, 2013). ‹
³License 2² 
This license does not authorize any military use of OCB. Aside from
military uses, you are authorized to make, use, and distribute (1) any
software implementation of OCB and (2) non-software implementations of OCB
for noncommercial or research purposes. You are required to include notice
of this license to users of your work so that they are aware of the
prohibition against military use. This license terminates for you if you
sue someone over an implementation of OCB authorized by this license
claiming that you have a patent covering their implementation.
This is a non-binding summary of a legal document (the link above). The
parameters of the license are specified in the license document and that
document is controlling.

P.S. GCM may be slower - but at least I don't need a law degree to figure
out what can be done with it.
P.P.S. My assembly skills are rusty, but I didn't find use of CLMUL in the
assembly code. Could you clarify whether only AES-NI instructions were
used, or CLMUL was used too? Tnx!

--
Regards,
Uri Blumenthal
<Disclaimer>

On 2/5/13 17:17 , "Ted Krovetz" <[email-masked]> wrote:

>Phil has issued broad licenses for OCB, allowing open-source software
>implementations and software implementations in non-military contexts and
>non-commercial non-military hardware implementations. The licenses are at
>
>It is my understanding -- correct me if I'm wrong -- that IP disclosures
>do not go directly in the RFC but instead get disclosed to the IETF along
>with the RFC submission. This has been done and the disclosures are at
>
>  
>These have not been updated for Sandy Bridge or Ivy Bridge. I can tell
>you that under Sandy Bridge OCB takes just 0.87 cycles per byte when
>processing 4KB messages. The fastest GHASH implementation I know about is
>Andy Polyakov's OpenSSL implementation that runs at 2.0 cycles per byte
>(just for GCM's hashing, you'd have to add the cost of encryption to get
>GCM's overall speed). Sandy Bridge and Ivy Bridge did not improve
>PCLMULQDQ performance but did improve AESENC performance, meaning that
>Sandy and Ivy improved OCB's performance much more than GCM's.
>
>-Ted
>
>
>_______________________________________________
>Cfrg mailing list
>[email-masked]
>http://www.irtf.org/mailman/listinfo/cfrg

---

From: Ted Krovetz <[email-masked]>
Date: Tue, 5 Feb 2013 19:06:34 -0800

> "License 1" and "License 2"?

People pick whichever they want. If a product is open source, they'll likely prefer License 1. If the product is closed they'll likely prefer License 2.

> used, or CLMUL was used too? Tnx!

Yes indeed. We used the GCM implementation from OpenSSL, which uses CLMUL.

---

From: Yoav Nir <[email-masked]>
Date: Wed, 6 Feb 2013 06:17:09 +0000

> People pick whichever they want. If a product is open source, they'll likely prefer License 1. If the product is closed they'll likely prefer License 2.

How can it be used in a "product" if even license 2 is for non-commercial use? Also, why is "military use" specifically directed at the US military rather than any other military in the world?

Thanks

Yoav

---

From: Ted Krovetz <[email-masked]>
Date: Wed, 6 Feb 2013 07:57:41 -0800

> How can it be used in a "product"

Everything everyone produces is a product. I did not mean to imply commercial product.

> Also, why is "military use" specifically directed at the US military rather than any other military in the world?

The license says it applies to "foreign counterparts of these organizations."

> Let's say OCB gets added to OpenSSL ... How is this supposed to be enforced by the logistics company?

Nice point. We will confer with the authors of the license to clarify such scenarios.

Kevin's suggested modifications to the text are fine with me. I will wait to see the outcome of these discussions before making them, however.

-Ted

---

From: Joachim Strömbergson <[email-masked]>
Date: Thu, 07 Feb 2013 15:09:25 +0100

Aloha!

On 2013-02-05 23:17 , Ted Krovetz wrote:
> implementations and software implementations in non-military contexts
> and non-commercial non-military hardware implementations. The
> licenses are at
>

Why the distinction of open source SW, why not also allow open source HW?

-- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================

---

From: "Igoe, Kevin M." <[email-masked]>
Date: Mon, 11 Feb 2013 19:51:52 +0000

For sake of completeness, here are the IETF/IRTF IPR rules (http://irtf.org/ipr):

--------------------------------------------------------------------
The IRTF follows the IETF Intellectual Property Rights (IPR) disclosure rules.
This is a summary of these rules as they relate to IRTF research group discussions,
mailing lists and Internet Drafts:

*       If you include your own or your employer's IPR in a contribution to an
         IRTF research group, then you must file an IPR disclosure with the IETF.
*       If you recognize your own or your employer's IPR in someone else's
contribution and you are participating in the discussions in the research
group relating to that contribution, then you must file an IPR disclosure
with the IETF. Even if you are not participating in the discussion, the IRTF
still requests that you file an IPR disclosure with the IETF.
*       Finally, the IRTF requests that you file an IPR disclosure with the IETF if
you recognize IPR owned by others in any IRTF contribution.

The IRTF expects that you file IPR disclosures in a timely manner, i.e., in a period
measured in days or weeks, not months. The IRTF prefers that the most liberal licensing
terms possible are available for IRTF Stream documents, see RFC 5743. You may file an
IPR disclosure here: http://www.ietf.org/ipr/file-disclosure.

As long as the mailing list and authors agree that the IPR statement clearly
lays out the IPR situation correctly and unambiguously, the IPR can pretty much
say what it wants to say.  The "liberal licensing terms" mentioned above are a
suggestion, not a requirement.

Implementers are free to leave or take the OCB and its licensing conditions as
their legal console advises. I am not a lawyer, not do I play one on TV, but a
quick look at the patent office site seems to show all of the OCB patents chaining
back to a patent filed in 2001. To the best of my understanding this means both the
patents and the licensing constraints should vanish in the year 2021 (if so, the IPR
statement should consider mentioning this).  Hence licensing concerns for OCB are
a reasonably "short term" issue.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Ted Krovetz
> Sent: Tuesday, February 05, 2013 5:18 PM
> To: [email-masked]
> Subject: Re: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00
>
> and non-commercial non-military hardware implementations. The licenses
> are at
>
> It is my understanding -- correct me if I'm wrong -- that IP
> disclosures do not go directly in the RFC but instead get disclosed to
> the IETF along with the RFC submission. This has been done and the
> disclosures are at
>
>
> processing 4KB messages. The fastest GHASH implementation I know about
> is Andy Polyakov's OpenSSL implementation that runs at 2.0 cycles per
> byte (just for GCM's hashing, you'd have to add the cost of encryption
> to get GCM's overall speed). Sandy Bridge and Ivy Bridge did not
> improve PCLMULQDQ performance but did improve AESENC performance,
> meaning that Sandy and Ivy improved OCB's performance much more than
> GCM's.
>
> -Ted
>
>

---

From: "David McGrew (mcgrew)" <[email-masked]>
Date: Tue, 12 Feb 2013 14:08:47 +0000

Hi Ted and Everyone,

>https://datatracker.ietf.org/ipr/search/?option=document_search&id_documen

That's right, the IETF process for IPR disclosures is that the disclosures
are made regarding drafts and tracked as above.  Ted and Phil made the
appropriate IPR disclosure for Phil's patents a long time ago.   The
disclosures made for draft-krovetz-ocb apply to draft-irtf-cfrg-ocb as
well, and will apply to the RFC also.   These disclosures can be found at
<https://datatracker.ietf.org/doc/draft-irtf-cfrg-ocb/> at the bottom of
the page.

Over a year ago, Phil and Ted and I invited Gligor, Donescu, and IBM to
make a joint IPR statement, but unfortunately we did not hear back from
them.  

David