Subject: Fwd: Re: SRP in OpenSSH draft protocol spec

From: RJ Atkinson <[email-masked]>
Date: Mon, 02 Apr 2001 19:58:00 -0400

This should have been sent to the IETF SSH list as well.
Forwarded FYI.

Ran

>Date: Mon, 02 Apr 2001 16:39:02 -0700
>From: Tom Wu <[email-masked]>
>Organization: Arcot Systems
>X-Mailer: Mozilla 4.75 [en] (X11; U; Linux 2.2.14-5.0 i686)
>X-Accept-Language: en
>To: RJ Atkinson <[email-masked]>
>Subject: Re: SRP in OpenSSH draft protocol spec
>
>RJ Atkinson wrote:
>> 
>> Examples:
>>         RFC-1822
>>         RFC-1988
>>         (Other examples might exist; these just appeared
>> quickly when I searched rfc-index.txt)
>> 
>>         Obviously the language in the RFC should be wordsmith'd
>> by the patent holder's counsel to reflect which rights
>> (and limitations, if any) the patent holder is willing
>> to grant.  In the IETF context, there ought not be a
>> requirement for folks to individually and separately contact
>> the patent holder to obtain a licence -- instead some form
>> of general licence should be granted, IMHO.
>> 
>>         RFC-1790 & RFC-2339 might also be of interest,
>> though their scope is broader and a bit different than
>> the previous examples.
>
>Thanks for the references.  Clearly, though, not all companies choose to
>go through the trouble of the RFC process just for a license statement. 
>How do you feel about the other agreements listed in the IETF's IPR
>section, which do not have a corresponding RFC?
>
>>         The rest of us don't have a statement formally from
>> the patent holder indicating that SRP is free.  That is
>> a substantial legal problem lots of places.  While I believe
>> you, what matters is whether a court would take such on
>> trust (and a court would not).
>
>Have you contacted Stanford OTL, http://otl.stanford.edu/, for
>confirmation?
>
>> Thanks,
>> 
>> Ran
>> [email-masked]
>
>Tom
>-- 
>Tom Wu
>Principal Software Engineer
>Arcot Systems
>(408) 969-6124
>"The Borg?  Sounds Swedish..."

---

From: RJ Atkinson <[email-masked]>
Date: Mon, 02 Apr 2001 20:02:36 -0400

This should also have been copied to the IETF SSH list.
Forwarded now.  Sorry for overlooking the absence on 
the CC line.

Ran

>Date: Mon, 02 Apr 2001 19:56:49 -0400
>To: Tom Wu <[email-masked]>
>From: RJ Atkinson <[email-masked]>
>Cc: RJ Atkinson <[email-masked]>
>
>At 19:39 02/04/01, Tom Wu wrote:
>
>>How do you feel about the other agreements listed in the IETF's 
>>IPR section, which do not have a corresponding RFC?
>
>        Uncomfortable, on average.  Note that RFC-2026
>is NOT a shield from this concern because it defines the
>outer limits of what the IETF is permitted to agree to,
>rather than the day-to-day practices of the IETF.  On
>at least some occasions, IETF WGs have declined to permit
>a patented technology into the specification despite an
>online statement in the IPR section.
>
>        Publishing an Informational RFC isn't hard and need
>only be done once to clarify things.  Publishing standards-track
>RFCs is rather harder than Informational, I admit.
>
>>Have you contacted Stanford OTL, http://otl.stanford.edu/, 
>>for confirmation?
>
>        An important point is that one needs to have confidence 
>in the patent licence status without each of us having to 
>contact the patent holder.  
>
>        Stanford OTL has not responded yet to my enquiry, 
>purely as an aside.
>
>Ran

---

From: Darren Moffat <[email-masked]>
Date: Tue, 3 Apr 2001 12:33:30 -0700 (PDT)

>Note that there is at least one non-patented technology which is a
>possible alternative to SRP; see draft-perlman-strong-cred-00.txt.
>(affiliation disclaimer: Radia Perlman and I both work for Sun, though
>we are in completely different divisions of the company).

One additional data point is that the perlman draft is currently being
considered as one possibility for the SACRED WG.  The perlman draft
was explicitly written because of IRP issues.

--
Darren J Moffat