Subject: ECC PKINIT ID

From: Larry Zhu <[email-masked]>
Date: Wed, 18 Jul 2007 13:35:12 -0700

The question left is whether we want to make this on the standards track
or the informational track.

I propose to make this a standards track document. Please tell us what
you think.

--larry

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 18 Jul 2007 23:06:47 +0200

> I propose to make this a standards track document. Please tell us what

Can it be implemented freely without paying license fees?

If people need to pay license fees to be able to implement it (e.g., due
to patents), I would prefer to go with informational.

I believe it is better to standardize on something that is more likely
to be widely available for everyone.  RSA PKINIT or DSA PKINIT seems to
fit that better.  To make ECC available as Informational seems like a
good idea.  If there is a problem with RSA/DSA we can easily make the
switch.  Until there is a strong technical reason to go with ECC
instead, I believe having more options (especially if the patent
situation is unclear or worse) can actually hurt interoperability, and
thus ultimately security.

/Simon

---

From: Martin Rex <[email-masked]>
Date: Thu, 19 Jul 2007 01:38:41 +0200 (MEST)

> to patents), I would prefer to go with informational.

Wasn't the Certicom approach to require a premium for every ECC cert
issued by a CA instead of a license fee on the code implementing ECC?

This is a fairly minor improvement over traditional licencing schemes
(only the customer who actually uses it will have to cough up money),
but I'm pretty sure our legal department will prefer such a licensing
scheme.

I don't know which other companies claim patents around ECC,
and what their licensing schemes are.

-Martin

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 19 Jul 2007 12:42:06 +0200

> but I'm pretty sure our legal department will prefer such a licensing

A clarification, would they really prefer that licensing scheme over RSA
PKINIT or DSA PKINIT, which as far as I know, would not require any
license fees to be paid at all?

/Simon

---

From: Martin Rex <[email-masked]>
Date: Thu, 19 Jul 2007 17:07:02 +0200 (MEST)

> license fees to be paid at all?

IP-free (public domain or expired patents) and royalty free licensing
are still better, of course.

But among the existing fee-based licensing schemes, the Certicom
model seems preferable for developers and customers.

The advantage that I see is that the code can be implemented
and test and become part of the installed base before the
patent expires, and therefore can be used for free rather
quickly when the patent expires.

-Martin

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 23 Jul 2007 16:40:18 -0400 (EDT)

> license fees to be paid at all?

The question of what licensing scheme people prefer is out of scope for
this discussion.  We are not setting any licensing schemes.

The question of whether people prefer ECC over RSA, whether for technical
or licensing reasions, is also out of scope.  We are not discussion
whether to deprecate RSA or any other algorithm for PKINIT, nor are we
discussing changing mandatory-to-implement algorithms for PKINIT.

The question is, given that we have reached consensus on a way to use ECC
in PKINIT, do we want that to eventually become an Internet Standard?

-- Jeff

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 24 Jul 2007 00:13:36 +0200

> in PKINIT, do we want that to eventually become an Internet Standard?

To me, the answer to the last question depends on the licensing terms of
the relevant technology (i.e., apparently ECC in this case).

Generally, I think it is a bad idea to publish documents that people
can't implement and use freely on the IETF standards track.

I believe good licensing terms is a valid criteria when deciding whether
to put something on the standards track or not.

/Simon

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 23 Jul 2007 18:30:33 -0400 (EDT)

> to put something on the standards track or not.

It's fine to discuss what the licensing terms actually appear to be, and
to take that into account when determining whether it's worthwhile to
standardize an encumbered technology.  However, it's pointless to waste
time arguing over what different terms might be more or less desirable.

-- Jeff

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Mon, 23 Jul 2007 18:30:37 -0500

> I propose to make this a standards track document. Please tell us what

I think its a informational track document.

Love

---

From: Martin Rex <[email-masked]>
Date: Tue, 24 Jul 2007 12:11:57 +0200 (MEST)

> in PKINIT, do we want that to eventually become an Internet Standard?

Sorry for having caused OT discussion.

As long as the current IPR claims are not expired, I'm favouring
informational status for the document.  There may be interest in
revisiting this decision when the applicable patents expire and
to put (the successor of) this document on the standards track.

-Martin

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 24 Jul 2007 12:35:19 +0200

> to put (the successor of) this document on the standards track.

Given what I've read so far, I'd favor Informational as well, for the
same reason as Martin.

/Simon

---

From: Sam Hartman <[email-masked]>
Date: Wed, 25 Jul 2007 11:12:45 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> The question is, given that we have reached consensus on
    Jeffrey> a way to use ECC in PKINIT, do we want that to eventually
    Jeffrey> become an Internet Standard?

Although, of course, considering the licensing for ECC in making this
decision is a fine thing for us to do.