Subject: Re: Fourth Last Call: draft-housley-tls-authz-extns

From: Simon Josefsson <[email-masked]>
Date: Mon, 09 Feb 2009 19:06:18 +0100

The IESG <[email-masked]> writes:

> Since the third Last Call, RedPhone Security filed IETF IPR disclosure
> 1026.  This disclosure statement asserts in part that "the techniques
> for sending and receiving authorizations defined in TLS Authorizations
> Extensions (version draft-housley-tls-authz-extns-07.txt) do not
> infringe upon RedPhone Security's intellectual property rights".  The
> full text of IPR disclosure 1026 is available at:
>
> 	https://datatracker.ietf.org/ipr/1026/
>
> This Last Call is intended to determine whether the IETF community
> had consensus to publish  draft-housley-tls-authz-extns as a
> proposed standard given IPR Disclosure 1026.

Given the patent disclaimer from RedPhone, I'm against publishing this
as a proposed standard.

It seems no license is demanded to implement the technology, which is a
step in the right direction.

It also seems clear that RedPhone will demand a license for _use_ of the
technology.  Practical use-cases appears to be covered by this demand.
That makes the technology unsuitable as a proposed standard to me.

I am also concerned that the earlier patent disclaimer #765 is not
available:

  https://datatracker.ietf.org/ipr/765/

This makes it impossible for the community to review the history around
the licensing conditions.  This seems contrary to the requirements of
RFC 3979 aka BCP 0079:

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

Thus it seems the policies around patent disclosures have not been
followed by the IETF itself here.

/Simon

---

From: SM <[email-masked]>
Date: Tue, 10 Feb 2009 02:32:38 -0800

At 08:18 14-01-2009, The IESG wrote:
>The IESG is considering approving this draft as a standards track
>RFC. The IESG solicits final comments on whether the IETF community has
>consensus to publish draft-housley-tls-authz-extns as a proposed
>standard. Comments can be sent to [email-masked] or exceptionally to

The latest IPR disclosure posted since the third Last-Call does not 
require any license for implementors.  However, there are constraints 
on the the use of the technique specified in 
draft-housley-tls-authz-extns-07.  This draft has been a matter of 
discussion since June 27, 2006.  It is nearly three years and yet 
there still isn't any implementation available or any deployment.

Because of the lack of implementation and the narrow use that can be 
made of the technique described in the draft, it is my view that it 
doesn't warrant publication on the Standards Track.

Regards,
-sm