Subject: Re: Fourth Last Call: draft-housley-tls-authz-extns

From: Sean Foy <[email-masked]>
Date: Sun, 8 Feb 2009 15:15:25 -0600

I share the concerns of the FSF
[http://www.fsf.org/news/reoppose-tls-authz-standard] and Simon
Josefsson [http://www.ietf.org/mail-archive/web/ietf/current/msg55059.html]
about the TLS-authz draft.

The usefulness of the proposed standard
http://tools.ietf.org/id/draft-housley-tls-authz-extns-07.txt appears
to be severely limited by the patent disclosed in
https://datatracker.ietf.org/ipr/1026/. For example, if the
authorization is intended to play a role in the enforcement or
implementation of "any legally recognizable and documented agreement
between two parties," then RedPhone Security apparently asserts patent
infringement in their IPR.

The offer of "fair and nondiscriminatory" license grants is unclear,
but similar offers in the past have excluded use in free software.

Please continue to oppose this standard until RedPhone's patent is
invalidated or they provide a royalty-free license for all users.

Sean Foy

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 10 Feb 2009 13:00:02 -0800

I do not support publication of this document as a Proposed Standard via
the AD-sponsored route, for several reasons:

a.  I believe that this document should have been handled as a WG work item.   
It should not be commonplace for standards track security documents to be 
handled outside of a WG.  This issue has been addressed in IPsec (via
IPSECME), and TLS needs to follow suit.  If the TLS WG does not wish to 
deal with this and other documents, then the IETF should considered formation 
of a new WG. 

b.  This document has become a lightening rod for attacks on the integrity
of the IETF and IESG.  While many of these attacks are groundless, proceeding 
with the approval of this document without addressing the underlying problems 
would send the wrong message about the IETF's commitment to ethics. 
> -----Original Message-----
> From: ietf-announce-bounces at ietf.org 
> [mailto:ietf-announce-bounces at ietf.org] On Behalf Of The IESG
> Sent: 14 January 2009 16:18
> To: IETF-Announce
> Subject: Fourth Last Call: draft-housley-tls-authz-extns
> 
> On June 27, 2006, the IESG approved "Transport Layer Security 
> (TLS) Authorization Extensions," 
> (draft-housley-tls-authz-extns) as a proposed standard. On 
> November 29, 2006, Redphone Security (with whom Mark Brown, a 
> co-author of the draft is affiliated) filed IETF IPR disclosure 767. 
> 
> Because of the timing of the IPR Disclosure, the IESG 
> withdrew its approval of draft-housley-tls-authz-extns.  A 
> second IETF Last Call was initiated to determine whether the 
> IETF community still had consensus to publish  
> draft-housley-tls-authz-extns as a proposed standard given 
> the IPR claimed.  Consensus to publish as a standards track 
> document was not demonstrated, and the document was withdrawn 
> from IESG consideration.
> 
> A third IETF Last Call was initiated to determine whether the 
> IETF community had consensus to publish 
> draft-housley-tls-authz-extns as an experimental track RFC 
> with knowledge of the IPR disclosure from Redphone Security.  
> Consensus to publish as experimental was not demonstrated; a 
> substantial segment of the community objected to publication 
> on any track in light of the IPR terms.
> 
> Since the third Last Call, RedPhone Security filed IETF IPR 
> disclosure 1026.  This disclosure statement asserts in part 
> that "the techniques for sending and receiving authorizations 
> defined in TLS Authorizations Extensions (version 
> draft-housley-tls-authz-extns-07.txt) do not infringe upon 
> RedPhone Security's intellectual property rights".  The full 
> text of IPR disclosure 1026 is available at:
> 
> 	https://datatracker.ietf.org/ipr/1026/
> 
> This Last Call is intended to determine whether the IETF 
> community had consensus to publish  
> draft-housley-tls-authz-extns as a proposed standard given 
> IPR Disclosure 1026.
> 
> The IESG is considering approving this draft as a standards 
> track RFC. The IESG solicits final comments on whether the 
> IETF community has consensus to publish 
> draft-housley-tls-authz-extns as a proposed standard. 
> Comments can be sent to ietf at ietf.org or exceptionally to 
> iesg at ietf.org. Comments should be sent by 2009-02-11.
> 
> A URL of this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-housley-tls-authz-extns-07.txt

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 9 Feb 2009 22:54:19 -0800

I do not support publication of this document as a Proposed Standard, for
several reasons:

a.  I believe that the subject of this document (TLS authorization) is of
fundamental importance to a number of IETF WGs, and therefore it should
not be handled via AD-sponsorship, but rather within a WG.  If the TLS 
WG does not wish to deal with the document, then the IETF should
consider formation of a new WG to deal with this and other TLS extensions. 

b.  This document has become a lightening rod for attacks on the integrity
of the IETF and IESG.  Rather than ignoring the concerns that have been
raised, I believe that the IETF needs to tackle them head on, by initiating
reforms in the areas of affiliation disclosure and conflict of interest within
the IESG.  Given the current controversy, approving this document could
be interpretted as a lack of concern about those issues.  

c. I'm not convinced that the latest Redphone IPR disclosure represents
a substantive rather than a cosmetic change from previous disclosures.

---

From: Pablo 'merKur' Kohan <[email-masked]>
Date: Wed, 11 Feb 2009 02:30:55 +0200

I'm writing to ask you not to approve the proposed patent-encumbered  
standard for TLS authorization.

We've achieved a massive technological progress, thanks to IETF and  
other bodies which strive for standardization of OPEN specifications.

Allowing a patent-encumbered (without a non-revokable royalty-free  
license) standard to be approved, will weaken not only the IETF, but  
the open standards community as a whole.

I urge the IETF to send a strong signal in support of TRUE OPEN  
STANDARDS by rejecting this proposed standard until RedPhone provide a  
non-revokable, royalty-free license for all users.

Thanks,
Pablo Kohan

-- 
____________________________  ________  _______________________________
|   Pablo 'merKur' Kohan      \   \  /                                |
|       Founder, CEO           \   \/    To bring IN-OVATION turn to  |
|  mailto:[email-masked]      /\   \   your open source of solutions |
| Phone:  +972-54-422-5371    /  \   \                                |
| Fax:    +972-50-681-1928    --------      http://www.ximpo.com/     |
|__________________________ Ximpo  Group _____________________________|

---

From: Robert Schott <[email-masked]>
Date: Mon, 9 Feb 2009 20:40:29 -0600

This standard should be wholly withdrawn until all patent
encumberances are fully removed.

GNU's statement summarizes it well:

http://www.fsf.org/news/reoppose-tls-authz-standard

 Much of the communication on the Internet happens between computers
according to standards that define common languages.  If we are going to
live in a free world using free software,  our software must be allowed
to speak these languages.

Unfortunately, discussions about possible new standards are tempting
opportunities for people who would prefer to profit by extending
proprietary control over our communities. If someone holds a software
patent on a technique that a programmer or user has to use in order to
make use of a standard, then no one is free without getting permission
from and paying the patent holder. If we are not careful, standards can
become major barriers to computer users having and exercising their freedom.

We depend on organizations like the Internet Engineering Task Force
(IETF) and the Internet Engineering Steering Group (IESG) to evaluate
new proposals for standards and make sure that they are not encumbered
by patents or any other sort of restriction that would prevent free
software users and programmers from participating in the world they define.

In February 2006, a standard for "TLS authorization" was introduced in
the IETF for consideration. Very late in the discussion, a company
called RedPhone Security disclosed (this disclosure has subsequently
been unpublished from the IETF website) that they applied for a patent
which would need to be licensed to anyone wanting to practice the
standard. After this disclosure, the proposal was rejected.

Despite claims that RedPhone have offered a license for implementation
of this protocol, users of this protocol would still be threatened by
the patent. The IETF should continue to oppose this standard until
RedPhone provide a royalty-free license for all users.

---

From: Joachim Achtzehnter <[email-masked]>
Date: Wed, 11 Feb 2009 16:45:09 -0800

> This Last Call is intended to determine whether the IETF community
> had consensus to publish  draft-housley-tls-authz-extns as a
> proposed standard given IPR Disclosure 1026.

In Disclosure 1026 RedPhone Security states the following:

  When an implementation generates the authorizations or processes
  these authorizations in any of the four ways described below, then
  this practice may be covered by RedPhone Security's patent claims.

This statement contradicts the earlier claim of non-infringement. Since it
will apparently still not be possible to create and use a functioning
implementation without infringing RedPhone's patents I oppose the adoption
of this proposed standard.

Thank You,

Joachim Achtzehnter
Professional Software Developer

-- 
private:  [email-masked]          (http://www.kraut.ca)