Subject: [OAUTH-WG] Fw: IPR Disclosure: - What to Do with JWT ?

From: Oleg Gryb <[email-masked]>
Date: Thu, 28 Feb 2013 11:21:06 -0800 (PST)

Dear OAuth WG and Chairs,

Can somebody please comment the Certicom's disclosure below? If the purpose of this disclosure is to inform us that JWT can be potentially a subject of royalties and other possible legal actions, the value of adopting JWT in the scope of OAuth 2.0 IETF standard would definitely diminish and if this is the case shouldn't we consider replacing it with something similar, but different, which would not be a subject of the future possible litigation?    

I'm not a lawyer and might not understand the statement below correctly, so please let me know if/where I'm wrong. Please keep in mind also that the popularity of JWT is growing fast along with the implementations, so we need to do something quickly.

Thanks,
Oleg.

--- On Wed, 2/27/13, IETF Secretariat <[email-masked]> wrote:

From: IETF Secretariat <[email-masked]>
Subject: [OAUTH-WG] IPR Disclosure: Certicom Corporation's Statement about IPR related to draft-ietf-oauth-json-web-token-06 (2)
To: [email-masked], [email-masked], [email-masked]
Cc: [email-masked], [email-masked], [email-masked]
Date: Wednesday, February 27, 2013, 4:16 PM

Dear Michael Jones, John Bradley, Nat Sakimura:

 An IPR disclosure that pertains to your Internet-Draft entitled "JSON Web Token
(JWT)" (draft-ietf-oauth-json-web-token) was submitted to the IETF Secretariat
on 2013-02-20 and has been posted on the "IETF Page of Intellectual Property
Rights Disclosures" (https://datatracker.ietf.org/ipr/1968/). The title of the
IPR disclosure is "Certicom Corporation's Statement about IPR related to draft-
ietf-oauth-json-web-token-06 (2)."");

The IETF Secretariat

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Leif Johansson <[email-masked]>
Date: Thu, 28 Feb 2013 21:13:23 +0100

On 02/28/2013 08:21 PM, Oleg Gryb wrote:
> Can somebody please comment the Certicom's disclosure below? If the
> purpose of this disclosure is to inform us that JWT can be potentially
> a subject of royalties and other possible legal actions, the value of
> adopting JWT in the scope of OAuth 2.0 IETF standard would definitely
> diminish and if this is the case shouldn't we consider replacing it
> with something similar, but different, which would not be a subject of
> the future possible litigation?   
>
> I'm not a lawyer and might not understand the statement below
> correctly, so please let me know if/where I'm wrong. Please keep in
> mind also that the popularity of JWT is growing fast along with the
> implementations, so we need to do something quickly.
>
I'm curious too.

Skimming through the summaries on google patents of the cited patents I
couldn't immediately see
the relationship with JWTs but then again I'm not a patent lawyer (nor
do I play one on the net).

        Cheers Leif

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 28 Feb 2013 23:36:48 +0200

Hi Oleg,

my personal experience with Certicom's IPR disclosures is that they 
focus on Elliptic Curve Cryptography. There were several IPR disclosures 
on documents in the JOSE WG and some of them contain ECC algorithms.

The JWT does not list an ECC algorithm but the referenced documents do.

Having said that the two cited IPRs seem to be:
http://www.google.com/patents/US6704870
http://www.google.com/patents/US7215773

Take a look at it and make your assessment whether there is anything we 
can change.

Ciao
Hannes

On 02/28/2013 09:21 PM, Oleg Gryb wrote:
> purpose of this disclosure is to inform us that JWT can be potentially a
> subject of royalties and other possible legal actions, the value of
> diminish and if this is the case shouldn't we consider replacing it with
> something similar, but different, which would not be a subject of the
> future possible litigation?
>
> I'm not a lawyer and might not understand the statement below correctly,
> so please let me know if/where I'm wrong. Please keep in mind also that
> the popularity of JWT is growing fast along with the implementations, so
> we need to do something quickly.
>
> Thanks,
> Oleg.
>
>
> --- On *Wed, 2/27/13, IETF Secretariat /<[email-masked]>/* wrote:
>
>
>     Subject: [OAUTH-WG] IPR Disclosure: Certicom Corporation's Statement
>     about IPR related to draft-ietf-oauth-json-web-token-06 (2)
>     [email-masked] </mc/compose?to=[email-masked]>

---

From: prateek mishra <[email-masked]>
Date: Thu, 28 Feb 2013 16:53:09 -0500

Two points  -

1) I request that this mailing list NOT be used for any substantive 
discussion of patent claims and so on. This will create difficulties for 
many participants and
I dont believe is within the charter of this effort.

2) I would encourage interested parties to review the following 
document, which may be relevant to this discussion

http://www.w3.org/2011/xmlsec-pag/

- prateek

> focus on Elliptic Curve Cryptography. There were several IPR 
> disclosures on documents in the JOSE WG and some of them contain ECC 
> algorithms.
>
> Take a look at it and make your assessment whether there is anything 
> we can change.
>
> Ciao
> Hannes
>
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 28 Feb 2013 23:57:00 +0200

This is certainly a good point. Stating whether certain claims are valid 
or not valid is not a good use of our time and may lead to legal 
problems later on.

So, read through the patents and make your own assessment whether this 
IPRs are a concern for you and whether you want anything in the drafts 
to be changed.

---

From: Leif Johansson <[email-masked]>
Date: Thu, 28 Feb 2013 23:23:44 +0100

On 02/28/2013 10:57 PM, Hannes Tschofenig wrote:
> This is certainly a good point. Stating whether certain claims are
> valid or not valid is not a good use of our time and may lead to legal
> problems later on.
>
good point. thx

---

From: Oleg Gryb <[email-masked]>
Date: Thu, 28 Feb 2013 16:26:17 -0800 (PST)

Prateek,

It's not so much a "patent claim" discussion as a suggestion to do something different than JWT if it's really protected by somebody's patents. It's a public standard after all and it's in the interests of everyone to keep it this way.  

--- On Thu, 2/28/13, prateek mishra <[email-masked]> wrote:

From: prateek mishra <[email-masked]>
Subject: Re: [OAUTH-WG] Fw:  IPR Disclosure: - What to Do with JWT ?
To: "Hannes Tschofenig" <[email-masked]>
Cc: [email-masked], [email-masked]
Date: Thursday, February 28, 2013, 4:53 PM

Two points  -

- prateek

---

From: Mike Jones <[email-masked]>
Date: Fri, 1 Mar 2013 02:33:33 +0000

With the caveat that I have not read the patent disclosures, I will add that if they pertain to Elliptic Curve Cryptography, RFC 6090 is likely relevant - especially http://tools.ietf.org/html/rfc6090#section-7.1 on ECDH and http://tools.ietf.org/html/rfc6090#section-7.2 on ECDSA.

				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of prateek mishra
Sent: Thursday, February 28, 2013 1:53 PM
To: Hannes Tschofenig
Cc: [email-masked]; [email-masked]
Subject: Re: [OAUTH-WG] Fw: IPR Disclosure: - What to Do with JWT ?

Two points  -

1) I request that this mailing list NOT be used for any substantive discussion of patent claims and so on. This will create difficulties for many participants and I dont believe is within the charter of this effort.

2) I would encourage interested parties to review the following document, which may be relevant to this discussion

- prateek

>> purpose of this disclosure is to inform us that JWT can be 
>> potentially a subject of royalties and other possible legal actions, 
>> the value of adopting JWT in the scope of OAuth 2.0 IETF standard 
>> would definitely diminish and if this is the case shouldn't we 
>> consider replacing it with something similar, but different, which 
>> would not be a subject of the future possible litigation?
>>

---

From: Oleg Gryb <[email-masked]>
Date: Thu, 28 Feb 2013 20:15:54 -0800 (PST)

Mike and Hannes,

Thanks. Very useful info that needs to be explored further. I actually like the W3C approach to the similar problem. It's described here: http://www.w3.org/2011/xmlsec-pag/pagreport.html 

1. They've created PAG.
2. Contacted the patent holder. 
3. Reviewed patent holder's proposal and rejected it as the one that doesn't meet W3C standards.
4. Created recommendations for the standard implementers, which is very important in my view.
5. Announced a decision that the work on the standard should go on.

Can we expect this kind of engagement from IETF and OAuth-WG or are we on our own and should do our own research as has been suggested below?

--- On Thu, 2/28/13, Mike Jones <[email-masked]> wrote:

From: Mike Jones <[email-masked]>
Subject: Re: [OAUTH-WG] Fw:  IPR Disclosure: - What to Do with JWT ?
To: "prateek mishra" <[email-masked]>, "Hannes Tschofenig" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thursday, February 28, 2013, 9:33 PM

                -- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of prateek mishra
Sent: Thursday, February 28, 2013 1:53 PM
To: Hannes Tschofenig
Cc: [email-masked]; [email-masked]
Subject: Re: [OAUTH-WG] Fw: IPR Disclosure: - What to Do with JWT ?

Two points  -

- prateek