Re: [TLS] Proto write-up for TLS exporter

[Simon Josefsson <simon at josefsson.org>]

<Pasi.Eronen at nokia.com> writes:

> Simon Josefsson wrote:
>
>> That is not factual, assertions have been made: #1004 claims Certicom
>> has patents that covers tls-extractor.  To what extent those patents
>> apply, and in what contexts, is more a legal question than a technical.
>
> Well, the assertion that has been factually made is the following:
>
>    At this time, Certicom believes its patents and patent applications
>    listed in Schedule A contain claims which may be necessary and
>    essential to implementations of the following protocols:
>
>    IETF TLS:
>
>    <...> "Keying Material Extractors for Transport Layer Security
>    (TLS)", draft-ietf-tls-extractor-02.txt when used with either:
>
>    A.  "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport 
>        Layer Security(TLS)" RFC 4492, May 2006; or, 
>    B.  "TLS Elliptic Curve Cipher Suites with SHA-256/384 and 
>        AES Galois Counter Mode," RFC 5289, or 
>    C.  "Suite B Cipher Suites for TLS," 
>        draft-rescorla-tls-suiteb-07.txt;

That is text from a PDF linked in 'Licensing information, comments,
notes, or URL for further information'.

> Your summary ("Certicom has patents that covers tls-extractor") seems
> to take the opinion that the "when used with either: A or B or C" text 
> is either not part of the assertion, or that this part doesn't matter.

That is right, I don't consider the PDF as part of the BCP79-required
disclosure.  It is extra information beyond what is required by BCP79.
The PDF can certainly be useful in evaluating claims, but I believe the
text that's in the #1004 disclosure should carry more weight.  And the
tls-extractor document is mentioned as a covered technology for the BCP
79 patent disclosure.

> My reading of the emails so far is that some others believe this
> part of the assertion text *does* matter (and has influenced their
> opinion about how to process the tls-extractor draft in IETF).

This seems to be the case.  I don't believe that view is consistent with
the requirements in BCP 79 on patent disclosures though.

/Simon