Subject: Re: [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exportersfor Transport Layer Security (TLS)) to Proposed Standard

From: Erick O <[email-masked]>
Date: Thu, 17 Sep 2009 23:44:06 -0700 (PDT)

________________________________
From: Joseph Salowey (jsalowey) <[email-masked]>
To: Dean Anderson <[email-masked]>
Cc: Simon Josefsson <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Sent: Wednesday, July 22, 2009 3:31:01 PM
Subject: Re: [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exportersfor Transport Layer Security (TLS)) to Proposed Standard

I agree with Simon that the IETF's disclosure page could use some work,
it seems rather confusing and it is not consistently filled out.

Comments inline below:  

> If your interpretation were correct, then we would have to 
> say that Certicom is not claiming IPR on _any_ IETF 
> document---draft or RFC---since none are listed in Section V. 
> But I think that is obviously incorrect---I think you have 
> misinterpreted what should be in which section.
>

[Joe] Are we both looking at https://datatracker.ietf.org/ipr/1154/?  In
section V I see several documents listed:

"RFC 3278, RFC 4109, RFC 4492, RFC 4753, RFC 4754, RFC 4869, RFC 5008,
RFC 5289, draft-rescorla-tls-suiteb-12, draft-green-secsh-ecc-07,
draft-igoe-secsh-suiteb-00, draft-ietf-smime-3278bis-07,
draft-ietf-smime-sha2-11"

> Section titles and descriptions: 
> 
>  Section IV. IETF Document or Other Contribution to Which 
> this IPR  Disclosure Relates: 
> 
>  Section V. Disclosure of Patent Information (i.e., patents 
> or patent  applications required to be disclosed by Section 6 
> of RFC 3979)
> 
> Section IV lists the drafts and RFCs.  Section V lists the patents.  
> One would not expect to find a draft or RFC listed in Section 
> V, nor a patent listed in Section IV.
> 
> Extractor and other documents are listed in section IV. 
> 

[Joe] Section V also has a sub-section C, which allows you to specify
what parts of IETF documents are covered by the patent information
disclosed in section V.  This section lists several documents which is a
subset of what is mentioned in section IV.  This seems straight forward
to me.  

Joe
>         --Dean
> 
> On Wed, 22 Jul 2009, Joseph Salowey (jsalowey) wrote:
> 
> > While I see that draft-ietf-tls-extractor is listed in section IV of
> > #1154 IPR disclosure as related material,  I see that it is 
> explicitly 
> > not listed in section V part C which lists what is specifically 
> > covered by the disclosure.  I don't think Certicom is 
> claiming IPR on 
> > draft-ietf-tls-extractor because it is not among the list 
> of documents
> > in section V.  
> > 
> > Joe
> > 
> > > -----Original Message-----
> > > From: [email-masked] 
> [mailto:[email-masked]] On Behalf 
> > > Of Simon Josefsson
> > > Sent: Wednesday, July 22, 2009 12:32 PM
> > > To: [email-masked]; [email-masked]
> > > Subject: Re: Last Call: draft-ietf-tls-extractor (Keying Material 
> > > Exportersfor Transport Layer Security (TLS)) to Proposed Standard
> > > 
> > > With the caveat that I have recently returned from vacation, and 
> > > consequently may have missed some clarifications or paged out some
> > > context:
> > > 
> > > If the #1154 IPR disclosure is the final word from 
> Certicom on this 
> > > document, I don't support advancing this document on the 
> standards 
> > > track.  My concern remains that Certicom claims they have 
> IPR that 
> > > covers the document -- that is what the
> > > #1154 disclosure says (section IV).  The additional information 
> > > provided in the PDF is not helping: it grants a license for use 
> > > together with ECC.  It doesn't say anything about the use without 
> > > ECC.
> > > 
> > > The way I see it, TLS implementers and the broader 
> Internet does not 
> > > gain something significant by having this document 
> published.  Other 
> > > IETF documents can use the TLS PRF to derive keying material.  On 
> > > the contrary, it seems both TLS implementers and the broader 
> > > Internet community would be hurt by publishing the document since 
> > > having patent threats looming over widely used techniques has 
> > > stability and interoperability impacts.
> > > 
> > > I recall that Certicom was positive about clarifying their 
> > > intentions so maybe we can continue that discussion and get 
> > > something more useful than the recent disclosure.
> > > 
> > > Speaking as TLS implementer of the document and document 
> [1] author 
> > > that reference this document, /Simon
> > > 
> > > [1]
> > > 
> http://tools.ietf.org/html/draft-josefsson-krb5starttls-bootstrap-02
> > > 
> > > The IESG <[email-masked]> writes:
> > > 
> > > > The IESG has received a request from the Transport 
> Layer Security 
> > > > WG
> > > > (tls) to consider the following document:
> > > >
> > > > - 'Keying Material Exporters for Transport Layer 
> Security (TLS) '
> > > >    <draft-ietf-tls-extractor-06.txt> as a Proposed Standard
> > > >
> > > > The IESG plans to make a decision in the next few weeks,
> > > and solicits
> > > > final comments on this action.  Please send substantive 
> comments 
> > > > to the [email-masked] mailing lists by 2009-08-10.
> > > Exceptionally, comments
> > > > may be sent to [email-masked] instead. In either case, please 
> > > > retain the beginning of the Subject line to allow 
> automated sorting.
> > > >
> > > > The file can be obtained via
> > > > 
> http://www.ietf.org/internet-drafts/draft-ietf-tls-extractor-06.tx
> > > > t
> > > >
> > > >
> > > > IESG discussion can be tracked via
> > > > 
> > > 
> https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&d
> > > Ta
> > > > g=16821&rfc_flag=0
> > > _______________________________________________
> > > Ietf mailing list
> > > [email-masked]
> > > https://www.ietf.org/mailman/listinfo/ietf
> > > 
> > _______________________________________________
> > TLS mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/tls
> > 
> > 
> 
> -- 
> Av8 Internet  Prepared to pay a premium for better service?
> www.av8.net        faster, more reliable, better service
> 617 344 9000  
> 
> 
> 
> 
_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Erick O <[email-masked]>
Date: Fri, 18 Sep 2009 07:32:56 -0700 (PDT)

________________________________
From: Erick O <[email-masked]>
To: Joseph Salowey (jsalowey) <[email-masked]>; Dean Anderson <[email-masked]>
Cc: Simon Josefsson <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Sent: Thursday, September 17, 2009 11:44:06 PM
Subject: Re: [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exportersfor Transport Layer Security (TLS)) to Proposed Standard

Joe

---

From: Erick O <[email-masked]>
Date: Fri, 18 Sep 2009 07:45:56 -0700 (PDT)

________________________________
From: Dean Anderson <[email-masked]>
To: Joseph Salowey (jsalowey) <[email-masked]>
Cc: Simon Josefsson <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Sent: Wednesday, July 22, 2009 2:57:29 PM
Subject: Re: [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exportersfor Transport Layer Security (TLS)) to Proposed Standard

If your interpretation were correct, then we would have to say that
Certicom is not claiming IPR on _any_ IETF document---draft or
RFC---since none are listed in Section V. But I think that is obviously
incorrect---I think you have misinterpreted what should be in which
section.

Section IV. IETF Document or Other Contribution to Which this IPR 
Disclosure Relates: 

Section V. Disclosure of Patent Information (i.e., patents or patent 
applications required to be disclosed by Section 6 of RFC 3979)

Section IV lists the drafts and RFCs.  Section V lists the patents.  
One would not expect to find a draft or RFC listed in Section V, nor a
patent listed in Section IV.

        --Dean

On Wed, 22 Jul 2009, Joseph Salowey (jsalowey) wrote:

> #1154 IPR disclosure as related material,  I see that it is explicitly
> not listed in section V part C which lists what is specifically covered
> by the disclosure.  I don't think Certicom is claiming IPR on
> draft-ietf-tls-extractor because it is not among the list of documents
> in section V.  
> 
> Joe
> 
> > From: [email-masked] [mailto:[email-masked]] On 
> > Behalf Of Simon Josefsson
> > Subject: Re: Last Call: draft-ietf-tls-extractor (Keying 
> > Material Exportersfor Transport Layer Security (TLS)) to 
> > Proposed Standard
> > 
> > With the caveat that I have recently returned from vacation, 
> > and consequently may have missed some clarifications or paged out some
> > context:
> > 
> > If the #1154 IPR disclosure is the final word from Certicom 
> > on this document, I don't support advancing this document on 
> > the standards track.  My concern remains that Certicom claims 
> > they have IPR that covers the document -- that is what the 
> > #1154 disclosure says (section IV).  The additional 
> > information provided in the PDF is not helping: it grants a 
> > license for use together with ECC.  It doesn't say anything 
> > about the use without ECC.
> > 
> > The way I see it, TLS implementers and the broader Internet 
> > does not gain something significant by having this document 
> > published.  Other IETF documents can use the TLS PRF to 
> > derive keying material.  On the contrary, it seems both TLS 
> > implementers and the broader Internet community would be hurt 
> > by publishing the document since having patent threats 
> > looming over widely used techniques has stability and 
> > interoperability impacts.
> > 
> > Speaking as TLS implementer of the document and document [1] 
> > author that reference this document, /Simon
> > 
> > [1] 
> > > The IESG has received a request from the Transport Layer Security WG
> > > - 'Keying Material Exporters for Transport Layer Security (TLS) '
> > > final comments on this action.  Please send substantive comments to 
> > > the [email-masked] mailing lists by 2009-08-10. 
> > Exceptionally, comments 
> > > may be sent to [email-masked] instead. In either case, please retain 
> > > the beginning of the Subject line to allow automated sorting.
> > >
> > > http://www.ietf.org/internet-drafts/draft-ietf-tls-extractor-06.txt
> > >
> > >
> > https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTa
> > > g=16821&rfc_flag=0