Subject: [IPsec] New criteria draft

From: Yaron Sheffer <[email-masked]>
Date: Thu, 11 Mar 2010 11:17:12 +0200

Hi,

Based on mailing list comments, I have posted a revision of draft-sheffer-ipsecme-pake-criteria here: http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs. I will submit it as usual when the submission window reopens.

Thanks,
     Yaron

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 11 Mar 2010 09:35:43 -0800 (PST)

Hi Yaron,

  One comment you might've missed was this:

     Also, the table in section 5 should include IEEE 802.11s under the
     "standards" column for SPSK. And the phrase "may or may not infringe
     on existing patents" applies to all candidates, and frankly, to
     almost everything in the IETF. It is a meaningless phrase and it
     would be better to just remove it from the "IPR" column.

That comment also received a "+1" from another commenter on the list.

  Also, I think this takes us down a particularly bad path:

   o  Ideally, the proposal should be unencumbered.  This property is
      very difficult to prove, and each WG participant should attempt to
      review the applicable patents and determine whether in fact they
      do not apply to the proposal.  Remember that independently
      invented technology might still infringe a patent.
   o  In some cases the IPR situation is clear: if the protocol relies
      on a specific patent, and believed to not require the use of any
      other.  This is mostly useful if the patent's licensing terms
      (whether free or not) are known, and/or the patent's expiration
      date is near.

  So while we start off our criteria grandly with "it should be
unencumbered" we immediately then dismiss that by saying we can't forget
it might still be patented by some unknown patent. So "ideally" is just
one of those states we cannot achieve because even if it's "unencumbered"
it might not be. So that's off, what's next? If the IPR situation is clear,
it relies on a specific patent and the patent's expiration date is near.
So I guess we're just supposed to stop here, right?

  It is unwise for anyone to say what another IP holder will say
with respect to his or her IPR. And there might be a patent that covers
everything done in the IETF, we just don't know and it's not our job to
prove a negative. So I think it would be very unfortunate if the discussion
of candidates jumped down this rathole. We would have "I'm not a lawyer
but..." followed by a contentious statement and 8 people jumping up to
the queue on the mic to precede their comments with "I'm not a lawyer
but..." and then make other contentious statements.

  I think the IPR content in this draft should be as simple as possible:

    o We live in a litigious world and patents are used as both a club
      and a shield.
    o Patents might or might not exist on every technology we discuss.
    o We should not attempt to prove or disprove whether this or that
      patent might or might not cover some technology.
    o It is not our job to prove that no patents apply to some technology.

  It would be great to choose a technology that does not require any
licensing but as we've seen in the last couple days even the most
straightforward and innocent of protocols that we choose to adopt can
still be encumbered.

  regards,

  Dan.

On Thu, March 11, 2010 1:17 am, Yaron Sheffer wrote:
> Hi,
>
> Based on mailing list comments, I have posted a revision of
> draft-sheffer-ipsecme-pake-criteria here:
> http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs. I will submit it
> as usual when the submission window reopens.
>
> Thanks,
>      Yaron
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: Yaron Sheffer <[email-masked]>
Date: Thu, 11 Mar 2010 20:33:37 +0200

Hi Dan,

thanks for your comments. Please see my response inline.

   Yaron

________________________________________
From: Dan Harkins [[email-masked]]
Sent: Thursday, March 11, 2010 7:35 PM
To: Yaron Sheffer
Cc: [email-masked]
Subject: Re: [IPsec] New criteria draft

  Hi Yaron,

<YS>

In fact, I did not miss these two comments. I did not list 802.11s because I prefer to list only standards that are primarily vetted by the security community. Hence the "Securty Standards" column in -01.

Regarding the second comment, while in principle I agree that it could apply to anything done at the IETF, unfortunately in our case it does apply. It applies because of two reasons:

- Spurious (whether legitimate or not, I cannot say) IPR statements made agaist SRP.

- The sheer amount of patents in this area that must be analysed to ensure, with a high level of confidence, that you will not be sued for implementing X.

And I disagree with your statement below, "It is not our job to prove that no patents apply to some technology." As individuals, and for many of us, as employees, it is our job to ensure ourselves that we (or our company) will not be getting into legal/financial trouble by making this choice.

And I don't think this is "proving a negative". We can think of a process to get this level of confidence. But just shouting at one another will not get us there. Please see http://tools.ietf.org/html/draft-mcgrew-fundamental-ecc-01 for a creative approach to deal with IPR in another, somewhat related, contentious area.

Having said that, if you read -01 carefully, you will see that I'd rather focus our energies on discussing the security aspects rather than endlessly discussing IPR.

And by the way, which protocol are you referring to in the last paragraph?

</YS>

  regards,

  Dan.

> as usual when the submission window reopens.

Scanned by Check Point Total Security Gateway.

---

From: thomwu <[email-masked]>
Date: Thu, 11 Mar 2010 11:43:06 -0800

Yaron,

Under the ³Security Standards² column, ISO IEC 11770-4 ³Mechanisms based on
weak secrets² should be mentioned.

SPEKE is ISO IEC 11770-4 KAM1
SRP is ISO IEC 11770-4 KAM2

KAM stands for ³Key Agreement Method² in the context of the ISO document.

Tom

On 3/11/10 1:17 AM, "Yaron Sheffer" <[email-masked]> wrote:

> http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs
> <http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs> . I will submit it

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 11 Mar 2010 11:45:16 -0800 (PST)

Hi Yaron,

On Thu, March 11, 2010 10:33 am, Yaron Sheffer wrote:
[snip]
>
> In fact, I did not miss these two comments. I did not list 802.11s because
> I prefer to list only standards that are primarily vetted by the security
> community. Hence the "Securty Standards" column in -01.

  Then neither draft-sheffer-emu-eap-eke nor draft-harkins-emu-eap-pwd
should be listed since EMU is no more "the security community" than 802.11
is and an individual submission is not necessarily vetted by anybody,
security or otherwise.

  I fail to see a rationale for only having "security standards" anyway.
The table is illustrative, it's showing where the underlying exchange is
used.

> Regarding the second comment, while in principle I agree that it could
> apply to anything done at the IETF, unfortunately in our case it does
> apply. It applies because of two reasons:
>
> - The sheer amount of patents in this area that must be analysed to
> ensure, with a high level of confidence, that you will not be sued for
> implementing X.

  Yes, it's true for our case. And, as I said, it's true for every case!
Statements of "it may or may not..." apply to everything. You could just
as easily, and correctly, said, "it may or may not be blue", or "it may or
may not be carbon-based". Since the statement applies to everything it
provides no meaning. It does mean something, though, when you selectively
apply a statement that is true for everything. Which is further
justification to remove it.

> And I disagree with your statement below, "It is not our job to prove that
> no patents apply to some technology." As individuals, and for many of us,
> as employees, it is our job to ensure ourselves that we (or our company)
> will not be getting into legal/financial trouble by making this choice.

  This is an IETF mailing list so I'm not using the 1st person plural
to mean collective individuals or employees of various companies. I'm
using it to mean people doing IETF business. It is not the function of
the IETF to provide legal opinion on the validity of patents to prevent
collections of individuals or various companies from "getting into
legal/financial trouble". So it is not our job _as IETFers_ to prove
whether patents do or do not exist and whether they apply to some
technology or not.

  You can provide your opinion to your company all you want, that is
eminently appropriate. I'll do the same to my company. And collectively
you and I as individuals can sit around a bar somewhere and hash out
IPR all we want. But getting into a "this applies and this doesn't apply
and there's the evil specter of the unknown that might also apply" in the
context of IETF work is not really approprate, and it's a rathole that we
would be better off avoiding.

> And I don't think this is "proving a negative". We can think of a process
> to get this level of confidence. But just shouting at one another will not
> get us there. Please see
> http://tools.ietf.org/html/draft-mcgrew-fundamental-ecc-01 for a creative
> approach to deal with IPR in another, somewhat related, contentious area.

  There doesn't have to be shouting to have a rathole.

  Yes, David's Fundamental ECC draft is creative and useful. There are
statements we can make regarding technology and the dates in which it
was brought to the public's attention and that can be used by the WG
when selecting a candidate. Let's take this as an example moving forward. 
We can make statements like:

    o "this technology was made public on <date>"; and,
    o "this technology is covered by <patent number>"; and,
    o "a patent has been applied for this technology on <date>"; and,
    o "when this technology was made public it was stated that
      no known patents applied and no patent applications were filed"

And since IPR has a time limit and we all acknowledge that something
"may or may not apply" to everything under the sun then we can then make
up our own minds on the topic. We don't need to get into the business of
arguing about whether a patent applies or not, or whether unknown patents
may or may not exist.

> Having said that, if you read -01 carefully, you will see that I'd rather
> focus our energies on discussing the security aspects rather than
> endlessly discussing IPR.

  Yes, but unfortunately you have written a criteria draft that will
ensure protracted and pointless IPR discussions when we get around to
evaluating the candidates.

  regards,

  Dan.