Subject: Re: Withdrawal of Approval and Second Last Call: draft-housley-tls-authz-extns

From: Brian E Carpenter <[email-masked]>
Date: Sun, 01 Apr 2007 08:46:38 +0200

On 2007-03-31 17:15, Eliot Lear wrote:
> Jeff,
>> As for informational vs an independent submission, I think there is a 
>> factor to be considered.  It seems to me that an informational IETF 
>> document is a fine way to say "this is a good idea, and we think this 
>> is the right way to do FOO, but we can't actually recommend it (for 
>> whatever reason)".  For example, we have at least one document that 
>> defines the use of elliptic curve cryptography with one of our 
>> protocols, which is informational because the working group that 
>> produced it didn't feel they could recommend it as a standard due to 
>> the hairy IPR issues surrounding that technology.

> Most people outside of this organization can't tell the difference 
> between a standard and an informational document.  They simply look at 
> the label "RFC" and are done.  And now you are trying to cut the line 
> even thinner?

I think Jeff is trying to leave the line exactly where it is: the WG
(or the IETF if there is no WG) decides case by case, within the
envelope first defined by RFC 2026 and confirmed by RFC 3668 and 3979.

Personally I prefer this to any doctrinaire rules or to reliance on
precedent.

     Brian

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Simon Josefsson <[email-masked]>
Date: Sun, 01 Apr 2007 22:24:02 +0200

"Mark Brown" <[email-masked]> writes:

> Simon,
>
> I filed for patent (Jan and Sep 2005) and later promoted TLS authz (Feb
> 2006) in good faith.  It is possible that the patent claims can be read more
> broadly than I expected, but that's a fairly detailed and unresolved legal
> question.  I am working diligently to -- let me speak carefully -- explore
> if and how I can make a royalty free license grant to ensure that promoting
> TLS authz continues to be an act in good faith, while still protecting a way
> for my company to make money on its IPR.

Thanks for responding, Mark.

In your opinion, what would an implementation have to do
(implementation-wise) in order to infringe on your patent?

Answering this, at least as far as your own informed opinion goes,
would be useful in determining if there is value for the IETF
community in standardizing this.  If typical real-world TLS libraries
in general would infringe on the patent, then I don't see how the IETF
community in general would benefit from having this on the standards
track.  In fact, I see serious problems if the IETF standardize
documents that the wide Internet community cannot use due to patent
concerns.

> I have experienced some surprises when mixing law and Internet standards.
> To try to avoid surprises, I have hired IPR attorneys at two different firms
> to review my draft which proposes a royalty-free license grant.  I expect
> any resulting license will be conditioned upon IETF acceptance of TLS authz
> as a standard.  I hope to have concluded these services next week.

Personally, I believe the temporal ordering should be the reversed.

> I think IPR questions are complicated in part because for some questions
> only a lawsuit can answer the question -- but we should all want to stay
> clear of these kinds of lawsuits!  So answers seem to me to be in short
> supply.

Making your thoughts and opinions clear and public goes a long way to
disseminate the intent behind the patent.  The IETF permits patented
technology, but to make an informed decision how to respond to "do we
want to standardize this" (i.e., the IETF-wide last call) there needs
to be sufficient information available for participants to form an
opinion.

> I want to craft the proposed license to make this situation a little
> clearer than that, but doing so often involves taking risks of
> giving away a huge loophole.  So I'm working to get good legal
> advice.
>
> In short, I am working to create a royalty-free license grant -- hopefully I
> can disclose it next week.  With some luck, it will clarify the situation.

I look forward to reading it!

Best regards,
Simon

> Best regards,
>
> mark
>
>> -----Original Message-----
>> From: Simon Josefsson [mailto:[email-masked]]
>> Sent: Thursday, March 29, 2007 10:12 AM
>> To: Sam Hartman
>> Cc: [email-masked]; [email-masked]; [email-masked]
>> Subject: Re: Withdrawal of Approval and Second Last Call: draft-housley-
>> tls-authz-extns
>> 
>> Sam Hartman <[email-masked]> writes:
>> 
>> >>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:
>> >
>> >     Simon> I don't care strongly about the standards track status.
>> >     Simon> However, speaking as implementer of the protocol: If the
>> >     Simon> document ends up as informational or experimental, I
>> >     Simon> request that we make an exception and allow the protocol to
>> >     Simon> use the already allocated IANA protocol constants.  That
>> >     Simon> will avoid interoperability problems.  I know the numbers
>> >     Simon> are allocated from the pool of numbers reserved for
>> >     Simon> standards track documents.  There is no indication that we
>> >     Simon> are running out of numbers in that registry.  Thus, given
>> >     Simon> the recall, I think the IETF should be flexible and not
>> >     Simon> re-assign the IANA allocated numbers at this point just
>> >     Simon> because of procedural reasons.
>> >
>> > Would you support publication on the standards track given the IPR
>> > situation as someone who has implemented?
>> 
>> If the patent concern is valid and covers TLS libraries or other
>> applications, no.
>> 
>> However, as far as I am aware of the public information that is
>> available, the situation appears to be that we don't know whether
>> these patents apply and to what extent.  I don't know whether the
>> patents were filed in good or bad faith.  More information from the
>> patent holders may help here.
>> 
>> If it is possible to implement the protocol without violating the
>> patents, I would support publication.  I've seen some claims that this
>> may be possible.  I have no interest in reading these patents myself,
>> but my position would be influenced if someone knowledgeable reads the
>> patents.
>> 
>> Given the amount of patents out there, it would be unreasonable for us
>> to move everything to informational just because someone finds
>> something that may be relevant to a piece of work.
>> 
>> The community needs to evaluate patent claims, and preferably reach
>> conservative agreement (rough consensus is not good enough) on whether
>> we should care about a particular patent or not.  Input to that
>> community evaluation process may be documentation of legal actions
>> taken by a patent owner.  Sometimes that may happen only after a
>> document has been published.
>> 
>> I would support down-grading standards track documents that later turn
>> out to be patent-infected to informational.  Doing so would avoid
>> sending a message that the IETF supports patented technology, when the
>> IETF community didn't know about the patents at publication time.  For
>> credibility of the process, I believe it is important that these
>> decisions are only made based on publicly available information.
>> 
>> /Simon
>
>

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 03 Apr 2007 21:27:24 +0200

--On 29. mars 2007 11:50 -0500 Mark Brown <[email-masked]> wrote:

> 2006) in good faith.  It is possible that the patent claims can be read
> more broadly than I expected, but that's a fairly detailed and unresolved
> legal question.  I am working diligently to -- let me speak carefully --
> explore if and how I can make a royalty free license grant to ensure that
> promoting TLS authz continues to be an act in good faith, while still
> protecting a way for my company to make money on its IPR.

Mark,

trying to understand your statement above:
When you submitted draft-housley-00, August 2006, your submission included 
the text:

   By submitting this Internet-Draft, each author represents that any
   applicable patent or other IPR claims of which he or she is aware
   have been or will be disclosed, and any of which he or she becomes
   aware will be disclosed, in accordance with Section 6 of BCP 79.

You were clearly aware of your own patent filing.

The Redphone IPR statement, 
<https://datatracker.ietf.org/public/ipr_detail_show.cgi?ipr_id=765>, was 
filed on November 28, 2007; I cannot see any earlier filing in your name.

I can reconcile those two things with your assurance of good faith in 
multiple ways:

- You were not aware that section 6.2.1 of BCP 79 requires a disclosure "as 
soon as reasonably possible". In this case, we need to update the 
informational material we provide to people who might submit I-Ds.
- You were of the opinion that 15 months after the I-D filing was "as soon 
as reasonably possible". In this case, we need to have an IETF debate on 
whether we think this is a reasonable assessment, and document the result 
of that discussion.
- You were of the opinion that the patent applications were certainly not 
applicable to the specification in that draft, but changed your opinion 
later.
- There is some logic here that I do not yet grasp, and I need further 
explanation.

Rather than speculating about which of the alternatives above is true, I 
prefer to ask.
Take care,

                 Harald Alvestrand

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 4 Apr 2007 01:04:21 +0200

On 4 apr 2007, at 00.45, Mark Brown wrote:

> Harald,
>
> I want to apologize again for screwing up the IPR disclosure process.
>
> Normal IPR disclosure process is to alert the IETF community via  
> the IETF
> website that a patent has been filed.  I mistakenly thought that  
> adding the
> boilerplate IPR statement at the top of the ID was sufficient to  
> say what
> needed to be said.  However, I don't think IETF requires the  
> disclosure of
> an unpublished patent application.

I believe that is required even for patent applications.  RFC 3979  
talks about patent applications in several places.

> I finally made my disclosure on the IETF website (what I mistakenly  
> thought
> was a second disclosure) after my patent got published.  And, in all
> honesty, even this disclosure got delayed because I sought advice.   
> Please
> note that the filing's publication, the delay, and the IPR  
> disclosure all
> happened after the last IETF approval for the ID.  The right thing  
> to do is
> to use the IETF website the very day your file your first ID, and  
> not hope
> that the verbiage atop the ID will somehow disclose that IPR  
> filings are in
> progress.

Yes, filing IPR disclosures as soon as possible is what the rules says.

> As a result of my mistakes, the IETF withdrew approval of the ID and
> explained the process to me.  That's fair.  But please keep in mind  
> that
> even for important things, it's easy to make mistakes your first time
> through a process.

That is understandable.  However, I believe it is in the best  
interest for the IETF community to put only one specification on the  
standards track to solve a particular problem.  Some claim that it is  
possible to write a new document to address authorization in TLS  
without infringing on your patent.  Thus, if these patents are  
problematic for TLS implementations, I think it is better to not  
publish this as a standards track document, and encourage alternative  
solutions to be published on the standards track.

/Simon

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 04 Apr 2007 03:28:09 +0200

Thanks Mark - this makes it clear that we need to work on our information 
materials, to make it clear to people what the requirement is.

BTW, RFC 3979 doesn't make a difference between published and unpublished 
applications - both require a disclosure. Section 6.4.1 describes how to 
refer to an unpublished application - section 6.4.2 talks about the 
procedure for updating a disclosure when the status of a patent application 
changes.

                    Harald

---

From: "Mark Brown" <[email-masked]>
Date: Tue, 3 Apr 2007 17:45:50 -0500

Harald,

Normal IPR disclosure process is to alert the IETF community via the IETF
website that a patent has been filed.  I mistakenly thought that adding the
boilerplate IPR statement at the top of the ID was sufficient to say what
needed to be said.  However, I don't think IETF requires the disclosure of
an unpublished patent application. 

I finally made my disclosure on the IETF website (what I mistakenly thought
was a second disclosure) after my patent got published.  And, in all
honesty, even this disclosure got delayed because I sought advice.  Please
note that the filing's publication, the delay, and the IPR disclosure all
happened after the last IETF approval for the ID.  The right thing to do is
to use the IETF website the very day your file your first ID, and not hope
that the verbiage atop the ID will somehow disclose that IPR filings are in
progress.

As a result of my mistakes, the IETF withdrew approval of the ID and
explained the process to me.  That's fair.  But please keep in mind that
even for important things, it's easy to make mistakes your first time
through a process.

--mark

---

From: "Mark Brown" <[email-masked]>
Date: Tue, 3 Apr 2007 17:45:50 -0500

Harald,

--mark

---

From: "Mark Brown" <[email-masked]>
Date: Wed, 4 Apr 2007 08:49:46 -0500

Simon,

> talks about patent applications in several places.

You're right, please let me correct myself again here.  My use of the term
"disclosure" was sloppy.  Here's what I was told by IESG:

> >The IESG has been informed by Mark Brown that he had knowledge of the 
> >September 2005 patent application filed by his employer at the time 
> >he submitted draft-housley-tls-authz-extns. Accordingly, he was 
> >obligated to disclose the existence of this patent application upon 
> >making this submission. Making a required IPR disclosure after a 
> >draft is approved does not meet the requirement to promptly make the 
> >disclosure. According to section 7 of RFC 3979 failure to make a 
> >required disclosure is a failure of process. It should be noted that 
> >the above disclosure obligations apply to unpublished patent 
> >applications. When a patent application that is required to be 
> >disclosed is unpublished, the discloser must 'indicate that the claim 
> >is based on unpublished patent applications', but is not required to 
> >list the application number (see RFC 3978 Section 6.4.1).

The content of the IETF-required IPR disclosure is this:

1. (YES) "the discloser must 'indicate that the claim is based on
unpublished patent applications'"

Not these:

2. (NO) "list the application number (see RFC 3978 Section 6.4.1)."
3. (NO) otherwise publish to the IETF the pending patent claims or
description of the invention disclosed in any unpublished patent
application(s)

What I meant to say in my earlier email is that I don't think IETF requires
disclosure of the body of the patent application, it's claims, etc. as in
(3). I recognize that IETF does require thesmtp.mc.mpls.visi.com)
	by ietf-mx.ietf.org with esmtp (Exim 4.43)
	id 1HZ5rU-0006pm-54; Wed, 04 Apr 2007 09:49:22 -0400
From: "Mark Brown" <[email-masked]>
To: "'Simon Josefsson'" <[email-masked]>
Date: Wed, 4 Apr 2007 08:49:46 -0500
Cc: 'Harald Tveit Alvestrand' <[email-masked]>,
	'Sam Hartman' <[email-masked]>, [email-masked], [email-masked]
Subject: RE: Withdrawal of Approval and Second Last
	Call:	draft-housley-tls-authz-extns

Simon,

> talks about patent applications in several places.

You're right, please let me correct myself again here.  My use of the term
"disclosure" was sloppy.  Here's what I was told by IESG:

> >The IESG has been informed by Mark Brown that he had knowledge of the 
> >September 2005 patent application filed by his employer at the time 
> >he submitted draft-housley-tls-authz-extns. Accordingly, he was 
> >obligated to disclose the existence of this patent application upon 
> >making this submission. Making a required IPR disclosure after a 
> >draft is approved does not meet the requirement to promptly make the 
> >disclosure. According to section 7 of RFC 3979 failure to make a 
> >required disclosure is a failure of process. It should be noted that 
> >the above disclosure obligations apply to unpublished patent 
> >applications. When a patent application that is required to be 
> >disclosed is unpublished, the discloser must 'indicate that the claim 
> >is based on unpublished patent applications', but is not required to 
> >list the application number (see RFC 3978 Section 6.4.1).

The content of the IETF-required IPR disclosure is this:

1. (YES) "the discloser must 'indicate that the claim is based on
unpublished patent applications'"

Not these:

2. (NO) "list the application number (see RFC 3978 Section 6.4.1)."
3. (NO) otherwise publish to the IETF the pending patent claims or
description of the invention disclosed in any unpublished patent
application(s)

What I meant to say in my earlier email is that I don't think IETF requires
disclosure of the body of the patent application, it's claims, etc. as in
(3). I recognize that IETF does require the required IPR disclosure made via
http://www.ietf.org/ipr-instructions as described in (1). 

This probably isn't news to any of you, but I wanted to correct my sloppy
use of the term "disclosure".

Thanks,

mark

 required IPR disclosure made via
http://www.ietf.org/ipr-instructions as described in (1). 

This probably isn't news to any of you, but I wanted to correct my sloppy
use of the term "disclosure".

Thanks,

mark

---

From: Russ Housley <[email-masked]>
Date: Fri, 06 Apr 2007 16:51:55 -0400

Dean:

>I'm still not clear on a few things:
>
>-- When did Russ Housley learn of the Patent Filing?

I was aware that Mark Brown was working on a patent; however, I did 
not begin working with him until after his provisional patent 
application was filed.  I did not see the claims until the filing 
became public.

Since I knew that a patent was in the works, but I did not know the 
details, at the time we submitted the -00  draft to the repository 
(which was February 2006), I reminded Mark Brown that an IPR 
statement might be necessary.

Russ

---

From: Russ Housley <[email-masked]>
Date: Fri, 06 Apr 2007 16:51:55 -0400

Russ

---

From: Russ Housley <[email-masked]>
Date: Fri, 06 Apr 2007 16:51:55 -0400

Russ