Re: SRP in OpenSSH draft protocol spec

[RJ Atkinson <rja%inet.org@localhost>]

At 18:49 02/04/01, Tom Wu wrote:
>RJ Atkinson wrote:
>> 
>>         IMHO, it would be more clear, hence more helpful,
>> if there were a published RFC along the lines of the content
>> at the URL above.  Several such examples exist in the current
>> RFC archives.  In particular, it would be good if the patent
>
>Can you point to any specific examples that you feel are representative of what you are looking for?  

Examples:
        RFC-1822
        RFC-1988
        (Other examples might exist; these just appeared
quickly when I searched rfc-index.txt)

        Obviously the language in the RFC should be wordsmith'd
by the patent holder's counsel to reflect which rights 
(and limitations, if any) the patent holder is willing
to grant.  In the IETF context, there ought not be a 
requirement for folks to individually and separately contact 
the patent holder to obtain a licence -- instead some form 
of general licence should be granted, IMHO.

        RFC-1790 & RFC-2339 might also be of interest,
though their scope is broader and a bit different than
the previous examples.

>Do you feel that the current IPR mechanism
>does not address your concerns adequately?

        Yes.  There is no formal statement from the
holder of the patent(s) [pending ?] about the licence
terms, so my concerns are quite substantially not yet 
addressed.

>There is a link to the Stanford OTL, where any firm's lawyers can
>contact Stanford's lawyers to get the appropriate legal assurances. 
>IANAL, I deal with the technical/cryptographic aspects of SRP and leave the legal issues to them.  It's free, that's the important 
>part as far as I'm concerned.

        The rest of us don't have a statement formally from
the patent holder indicating that SRP is free.  That is
a substantial legal problem lots of places.  While I believe
you, what matters is whether a court would take such on 
trust (and a court would not).

Thanks,

Ran
rja%inet.org@localhost