Subject: [tcpm] tcpsecure i-d IPR disclosure

From: Mark Allman <[email-masked]>
Date: Mon, 10 May 2004 22:26:22 -0400

Hi folks!

Just a quick note to let everyone know that Cisco has filed an IPR
disclosure with the IETF that claims ``one or more pending patent
applications relating to the subject matter of "Transmission Control
Protocol security considerations" <draft-ietf-tcpm-tcpsecure-00.txt>''.
The disclosure can be retreived from:

    http://www.ietf.org/ietf/IPR/cisco-ipr-draft-ietf-tcpm-tcpsecure.txt

A couple of notes ...

  * The disclosure was received soon after the tcpsecure i-d was
    published. (Which is when the WG Chairs & ADs found out about
    the patent applications.) Note that publishing an IPR disclosure
    after publishing an ID is OK according to the new IETF IPR
    guidelines.

  * Ted and I have engaged in discussions on this topic with the ADs
    (Allison and Jon) and Scott Bradner.  The discussions have not
    yet led to any recommended course of action, but our discussions
    are ongoing about how to proceed.

  * Please wait to discuss the effects of the IPR claims on the
    draft until we've clarified what claims are in place.

Thanks!

Mark & Ted

---

From: Tim Shepard <[email-masked]>
Date: Wed, 12 May 2004 15:50:40 -0400

>     draft until we've clarified what claims are in place.

You've asked us to wait, but can you give us any hint as to how long
it will be until you have "clarified what claims are in place"?

Given how this draft is being called a "CISCO/IETF recommendation" in
the press accounts I've seen recently, I believe it was a mistake to
take this draft in the form that it is in as a working group item
without consulting the consensus of the working group.

Nothing was achieved by placing the draft on the WG's agenda in
secret before public disclosure.  There would have been no harm in
waiting until the next IETF meeting.

I just re-read draft-ietf-tcpm-tcpsecure-00.txt and almost none of it
belongs in a draft that is a working group item of TCPM.

I believe that there is indeed a problem, and there is a possibility
that it would be appropriate to address the problem in TCPM, but
draft-ietf-tcpm-tcpsecure-00.txt fails even to explain well the
nature of the problem, and as has been discussed previously on this
mailing list, there are potential interoperability problems that make
the "solutions" in the draft inadvisable in general situations.

Perhaps some better-written or better-thought-through draft
addressing this issue might belong on this working group's agenda,
but not draft-ietf-tcpm-tcpsecure-00.txt .  Perhaps the best solution
lies outside the scope of TCPM (e.g. perhaps one should not make
visible the port numbers used to carry critical long-lived TCP
connections).

Note that TCP as it is used in most cases does not suffer from the
vulnerabilities 

			-Tim Shepard
			 [email-masked]

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm