Subject: RE: LPSK revisited (was RE: [Isms] Thoughts on Encapsulation)

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Thu, 5 May 2005 14:29:14 -0700

That's a valid concern.  Fortunately, Stanford U., which owns the 
IPR of the SRP method, has released a world-wide, royalty-free 
license for commercial and non-commercial use of SRP:

http://srp.stanford.edu/license.txt

I am not aware of the Cisco statement you mentioned, but I think 
it involves some specific implementation of SRP, not SRP itself.

Khanh

> -----Original Message-----
> From: David B Harrington [mailto:[email-masked]] 
>
> I have a concern about the use of SRP, since it is encumbered 
> by intellectual property issues.
> I infer from the Cisco IPR statement that implementers of an 
> SRP-based ISMS solution might be subject to licensing fees. I 
> don't think it is wise to build a standard atop encumbered protocols.
> 
> David Harrington
> [email-masked]
> 
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 5 May 2005 22:31:49 -0400

There were FUD issues risen around SRP patent, as some were claiming
that EKE patent is broad enough to cover SRP too. Since Stanford isn't
likely to defend SRP users in court if, say, Lucent chooses to enforce
its IPR on EKE...

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Khanh Nguyen (khanhvn)
Sent: Thursday, May 05, 2005 5:29 PM
To: [email-masked]; Sam Hartman; [email-masked]
Subject: RE: LPSK revisited (was RE: [Isms] Thoughts on Encapsulation)

Khanh

---

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Fri, 6 May 2005 16:16:10 -0700

> From: Blumenthal, Uri [mailto:[email-masked]] 
> 
> There were FUD issues risen around SRP patent, as some were 
> claiming that EKE patent is broad enough to cover SRP too. 
> Since Stanford isn't likely to defend SRP users in court if, 
> say, Lucent chooses to enforce its IPR on EKE...

As far as I know, Lucent has never formally claimed any IPR on SRP.
The FUD issue came up a few years ago when someone said Lucent was 
looking at the *possibility* of their EKE patents covering some 
aspects of SRP.  Lucent later issued a statement saying they didn't 
intent to do that.  

Anyway, LPSK is an abstract method that can work with many PSK auth
methods.  I picked SRP as an example because it's secure, relatively
simple and widely used, but other PSK methods (e.g. CHAP) can be 
used too.  CHAP and older PSK methods do not provide protection 
against off-line dictionary attacks, but that can be alleviated by 
enforcing some minimum password length, etc.  BTW, USM does not 
provide dictionary attack protection neither (except by min passwd 
length, etc.) and people don't see that as a big deal.

In the end, we can select not one but a few PSK methods for LPSK
implementation.  For example, iSCSI (RFC3720) supports both SRP and 
CHAP.  BTW, the iSCSI WG already examined SRP IPR issues pretty
thoughoutly.

Khanh