Subject: [Hipsec] [Fwd: Certicom IP Rights]

From: [email-masked] (Pekka Nikander)
Date: Sat Nov 1 00:27:01 2003

This is a multi-part message in MIME format.
--------------090409080306090603040100
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Should we be worried about this?  --Pekka

--------------090409080306090603040100
Content-Type: message/rfc822;
 name="Fwd: Certicom IP Rights"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="Fwd: Certicom IP Rights"

Date: Fri, 31 Oct 2003 15:29:27 -0500
To: [email-masked]
From: Russ Housley <[email-masked]>
Subject: Fwd: Certicom IP Rights
Cc: [email-masked], [email-masked]
Sender: [email-masked]

Dear IPsec Working Group:

I just got this note, which is a follow-up to a query that I sent to 
Certicom in July 2003.

I have asked Mr. McKinnon to post an updated IPR statement as soon as possible.

Russ

--- Original Message ---

To: [email-masked]
From: Ian McKinnon <[email-masked]>
Date: Fri, 31 Oct 2003 15:14:09 -0500

Dear Mr. Housley:

First, let me apologize for not responding sooner on our our Intellectual 
Property position re the August email stating that Certicom may have 
certain IP rights covering some aspects of the proposed IKEv2 proposal 
draft <draft-ietf-ipsec-ikev2-08.txt>.  Our IP group was totally consumed 
completing a $US 25 million IP licensing arrangement with the US 
Governments National Security Agency for a subset of our intellectual 
property portfolio for a limited field of use as it relates to its high 
assurance initiatives.

We wish to advise the IETF that Certicom believes it has rights under 
patents and/or pending applications that relate to RFC 3526 "More Modular 
Exponential (MODP) Diffie-Hellman Groups for Internet Key Exchange (IKE)", 
RFC 2409 "Internet Key Exchange",  Internet Draft 
(draft-ietf-ipsec-ikev2-11.txt) "Internet Key Exchange (IKEv2) Protocol" 
and other IETF standards using MODP Groups.  The applicable patents 
include, but are not limited to, US Patents #5,933,504, #6,563,928, 
#6,078,667, #6,178,507, #6,195,433, US Patent Application Publications 
#2001/0014153, #2002/0090085, and PCT Application #WO 00/01109, and 
corresponding foreign applications.

Some of the patents listed in the previous paragraph were part of the NSA 
licensing arrangement discussed in paragraph 1 as they relate to elliptic 
curve cryptography (ECC). For applications requiring higher levels of 
security, we believe that one should consider ECC for the technological 
advantages over other public-key schemes.

Certicom is willing to grant a royalty free license to the patents and 
patent pending listed in paragraph 2 for the purpose of practicing the art 
of public key cryptography as it pertains to IETF IKE standards in the 
limited field of use of MODP public key cryptography implemented using the 
well known Groups 1 and 2 as defined in RFC 2409.  Certicom will send the 
IETF terms of the royalty free license and will post this our web site shortly.

Outside the implementation of IETF IKE standards using well known Groups 1 
and 2 Certicom is prepared to grant a license to such intellectual property 
on reasonable, non-discriminatory terms and conditions, provided that the 
licensee provides a similar grant for any relevant patents under their 
control to Certicom.

Ian McKinnon
President and CEO
Certicom Corp

--------------090409080306090603040100--

---

From: [email-masked] (Michael Richardson)
Date: Mon Nov 3 11:09:01 2003

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Pekka" == Pekka Nikander <[email-masked]> writes:
    Pekka> Should we be worried about this?  --Pekka

  Yes/no.

  From what I understand about the claim (which was discussed at IPsec last
July), it applies to people who are generating MODP groups as used in DH
work. The algorithm that is claimed is never used in a production system.

  Rather, it is used by the person *writing the IETF document* to generate
an appropriate group. Certicom can not claim any rights to the resulting
*number*. That's silly. So, their offer is silly. It also tells me that their
lawyers possibly don't understand what their IP covers. 

] Collecting stories about my dad: http://www.sandelman.ca/cjr/ |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [