Subject: Another disclosure on draft-housley-tls-authz-extns

From: Sam Hartman <[email-masked]>
Date: Tue, 27 Feb 2007 12:16:06 -0500

Folks, it should be surprising to no one here that we've recieved the
following disclosure; it is a direct result of my mail yesterday.  I'd
ask the community to evaluate this potential  IPR in addition to the
disclosure from Redphone.

Subject: Posting of IPR Disclosure
From: IETF Secretariat <[email-masked]>
To: [email-masked], [email-masked]
Cc: [email-masked]
Date: Tue, 27 Feb 2007 11:41:08 -0500

Dear Russ Housley, Mark Brown:

An IPR disclosure that pertains to your Internet-Draft entitled "Transport Layer
Security (TLS) Authorization Extensions" (draft-housley-tls-authz-extns) was
submitted to the IETF Secretariat on 2007-02-27 and has been posted on the "IETF
Page of Intellectual Property Rights Disclosures"
(https://datatracker.ietf.org/public/ipr_list.cgi). The title of the IPR
disclosure is "Eric Rescorla's statement about possible IPR claimed in
draft-housley-tls-authz-extns-07.txt belonging to IBM Corporation."

The IETF Secretariat

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Peter Sylvester <[email-masked]>
Date: Wed, 28 Feb 2007 18:58:12 +0100

For your interest:

The document below has a date of 13 july 2005, it was a result of a 
reviews of several months by
various people in various areas of the French adminstration and other 
public services.

The text essentially does:

- establish a secure communication among two organisations using 
client/server authentication
- transport an authorisation statement from the client organisation to 
the other.

Two modes are specified: one over https, another using web services.

When using HTTPS, the authorisation statement (ands SAML assertion)
is transported as a header in http for the only reason that it 
simplified fast
implementation and experiments. When the first version of the
draft-housley-tls-authz-extns came out, I encouraged the authors to 
continue
since this seemed to me the logical separation of security data and 
application
data as a simple enhancement of what was specifiedin the following.
It is disappointing to read that there was a IPR activity done in parallel.

For those can't read French, you may want to ask Papa Bush to help you :-)

Just for the records: Will the next idea will be to create client 
certificates on
the fly and use an extended key usage to hold an authorisation 
statement? At least
for this you now have prior art established using this message :-)

https://www.ateliers.modernisation.gouv.fr/ministeres/projets_adele/adele_121_gestion_de/public/standard_dss_-_propo/downloadFile/file/Standard%20Interop%C3%A9rabilit%C3%A9-V1.0.pdf?nocache=1132133044.92