Subject: Re: iSCSI: SRP status

From: "Ofer Biran" <[email-masked]>
Date: Tue, 26 Mar 2002 20:16:29 +0200

David,

Can you clarify the statement

"...and that have been commercially deployed without licensing another
organization's patents."

Aren't you talking here about the patented SPEKE methods ?

 Thanks,
    Ofer

Ofer Biran
Storage and Systems Technology
IBM Research Lab in Haifa
[email-masked]  972-4-8296253

David Jablon <[email-masked]>@ece.cmu.edu on 26/03/2002 23:37:45

Please respond to David Jablon <[email-masked]>

Sent by:    [email-masked]

To:    [email-masked]
cc:    [email-masked]
Subject:    Re: iSCSI: SRP status

David,

Here are a few points to add to this summary of recent
events regarding SRP.

The first is simply that the just-posted policy letter from
Phoenix legal was presented and discussed in Minneapolis.
While I won't attempt to summarize that discussion here,
I have relayed the concerns expressed back to Phoenix.

A second point is a delicate one, related to larger IETF
policy in general. Concern was expressed at the meeting that
the WG appears to be changing the content (if not the
requirements too) of a proposed standard, based on
unconfirmed rumor.

The fact that a patent holder has refused to confirm or deny
such rumors, or provide a license policy statement, is
surely a concern.  But this concern may mask a pernicious
problem.  Such WG behavior allows anyone to start
unresolvable rumors of potential patent coverage in order to
steer a group in arbitrary directions.  Unfortunately, IETF
policy and tradition make open discussion of the legitimacy
of such rumors very difficult.

Concern was expressed at the meeting about security
dangers inherent in designing a new method, such as some
kind of mutually-authenticating variant of CHAP.  Even
beyond the security concerns, it may be impossible for the
group to determine that a newly proposed method is patent-
free.  The standard practices of using evidence of
surviving years of cryptographic review to establish
security, or commercial use to establish unencumbrance,
both may not work for methods still-to-be described.

The draft-jablon-speke-00.txt presented to the WG on this
list and at the meeting specifically describes methods that
provide the benefits of SRP, but are less structurally
related to EKE.  It describes methods that have survived
5 years of public scrutiny, that achieve higher goals than
the just-proposed alternatives, and that have been
commercially deployed without licensing another
organization's patents.

In presenting this information, I am clearly staying within
the guidelines of longstanding written IETF policy, but
clearly coming up against IETF tradition in talking as
openly as possible about such sensitive issues.

I hope that the group will carefully consider these methods,
in addition to any soon-to-be proposed variants of CHAP
or Diffie-Hellman, as they review their security and
functionality objectives.

Furthermore, in light of the repeated attempts to get
another company to clarify or simplify it's license
position, I would hope that any group or individual with
concern about the Phoenix position will make their concerns
known to the company, or to me personally, and I'll do my
best to get an acceptable response.

-- David Jablon

---

From: David Jablon <[email-masked]>
Date: Tue, 26 Mar 2002 19:42:03 -0500

Yes.

The words "another organization" mean "an organization other
than the owner of the SPEKE patent". The draft is intended
to clearly explain that the methods are subject to a patent currently
owned by Phoenix.  Please let me know if you find any of the
language there to be unclear.

-- David

---

From: David Wong <[email-masked]>
Date: Wed, 27 Mar 2002 16:10:56 -0500 (EST)

May I know which SRP infringe which cliam of 
SPEKE patent: US Patent 6,226,383?
I feel that SRP does not infringe anything of SPEKE
though it may infringe EKE patent
(I am sure SPEKE infringe EKE patent: 
US Patent 5,241,559 and US Patent 5,440,635. )

> >[email-masked]  972-4-8296253

______________________________________________________________________ 
File your taxes online! http://taxes.yahoo.ca

---

From: David Jablon <[email-masked]>
Date: Thu, 28 Mar 2002 01:36:58 -0500

>US Patent 5,241,559 and US Patent 5,440,635. )

Technical material to support a contradictory viewpoint to the
above is in www.ietf.org/internet-drafts/draft-jablon-speke-00.txt.
The draft is careful to not state feelings or legal conclusions,
but SPEKE has been openly licensed and deployed for years
without using the Lucent patents.

I'm probably the last person to be lecturing about IETF etiquette
in this regard, but I think it is improper to present unsupported feelings
and beliefs about patent issues in any standards group discussion.
Facts are helpful.  Rumors and unsupported opinion are not.

The specific question from <[email-masked]> has been forwarded
to the appropriate legal people within Phoenix.  However, responding
to anonymous email is probably not a high priority for them.

-- David

---

From: Tom Wu <[email-masked]>
Date: Wed, 27 Mar 2002 20:31:17 -0800

> The draft is careful to not state feelings or legal conclusions,

After reading the draft, I must respectfully disagree.  Although it 
doesn't state explicit legal conclusions such as "X is covered by patent 
Y", it makes statements of opinion like "X uses techniques from Y (which 
is patented)" or "X is fundamentally different from Y", which, if the 
reader believes these assertions, leads him/her to a corresponding legal 
opinion.  I would suggest that opinions w.r.t. IP be struck from the I-D.

> without using the Lucent patents.

But by that standard, so has SRP.  Has Phoenix (or Integrity Sciences) 
ever requested any IPR statement from Lucent regarding the EKE patents, 
similar to what the IPS WG has gone through the last few months?

> Facts are helpful.  Rumors and unsupported opinion are not.

Are "unsupported opinions" proper/improper in an Internet-Draft, though?

> to anonymous email is probably not a high priority for them.

Tom
-- 
Tom Wu
Principal Software Engineer
Arcot Systems
(408) 969-6124

---

From: David Jablon <[email-masked]>
Date: Thu, 28 Mar 2002 14:41:50 -0500

>I, David Jablon wrote:
>>[draft-jablon-speke-00.txt] is careful to not state feelings or legal conclusions,

At 08:31 PM 3/27/02 -0800, Tom Wu wrote:
>After reading the draft, I must respectfully disagree.  Although it doesn't state explicit legal conclusions such as "X is covered by patent Y", it makes statements of opinion like "X uses techniques from Y (which is patented)" or "X is fundamentally different from Y", which, if the reader believes these assertions, leads him/her to a corresponding legal opinion.  I would suggest that opinions w.r.t. IP be struck from the I-D.

Thanks.  I'll review those statements, and look into removing any
opinionated remarks.  However, I think it's important and helpful to
present facts about these methods to assist people in performing
their own analysis.

>But by that standard, so has SRP.  Has Phoenix (or Integrity Sciences) ever requested any IPR statement from Lucent regarding the EKE patents, similar to what the IPS WG has gone through the last few months?

Frankly, neither myself, Integrity Sciences, Phoenix, or,
as far as I know, any licensees of SPEKE, have seen any need to solicit
an opinion from Lucent in this regard.  All questions that I've heard
of have been resolved by analysis.  And to assist other people who
seek their own answers in this regard, the draft presents relevant facts.

What the IPS WG has done, in openly soliciting companies for opinions,
to confirm or deny rumors, appears to be unusual.
But whether this clarifies the situation, or obscures it, is not
obvious to me.  I think everyone's motives may be suspect.

How a patent holder responds to such a request must be weighed
*very* carefully, as I've mentioned earlier.  One could easily
abuse this process to chop out any targetted technology from any
IETF proposed standard.  If, for example, someone approached, say
Lucent, asking what how they feel about some new Diffie-Hellman-based
proposal, and they refused to answer, what would that mean?
Of if they gave a free license for that, but refused to answer about SPEKE,
which they might view as more of a competetive threat, what would
that mean?  Do we really want to be relying too-heavily on the veto
or blessing of any one person or corporation?

This is why I think it's very important for people to perform their own
analysis, and not rely on rumor, opinion, or too-heavily on the
assertions of any individual or corporation.

>Are "unsupported opinions" proper/improper in an Internet-Draft, though?

What I said applies to drafts too.
If anyone points out specific language of mine that appears to have
crossed this line, either privately or publicly, I'll definitely look into
correcting it.

-- David

---

From: Tom Wu <[email-masked]>
Date: Thu, 28 Mar 2002 15:23:33 -0800

> present facts about these methods to assist people in performing

[...]

> crossed this line, either privately or publicly, I'll definitely look into

In my opinion, section 4.10 of that I-D, in its entirety, crosses this 
line and sticks out like a sore thumb.  It presents no new facts about 
the techniques being discussed; the math behind SPEKE is already 
disclosed elsewhere in the draft, while the math behind SRP is disclosed 
in RFC2945.  What it does do, is present the author's unsupported 
opinion on what techniques are similar or different to/from other 
techniques.  I ask that it be removed.

Although I understand the need to justify the existence of an I-D that 
discusses patented, non-free technology, I submit that an I-D is an 
inappropriate place to state opinions about IP, even if it is done under 
the guise of "structural analysis".  More to the point, other I-Ds and 
RFCs, even in areas with IP disputes, like VRRP and the idn drafts, seem 
to have steered clear of including anything beyond a simple IPR Notice 
section, as mandated by RFC2026.  This is, of course, based on the 
documents I've managed to dig up so far; I'd be interested in hearing 
the opinion of someone with more experience in IETF procedure.

Tom

---

From: David Jablon <[email-masked]>
Date: Sat, 30 Mar 2002 15:55:15 -0500

Regarding feedback on draft-jablon-speke-00.txt ...

First, this draft is an informational document, and as such does
not have to strictly adhere to the requirements for an RFC.
Some relevant advice is found in RFC 3160:

>6.4.5 Patents in IETF Standards
>...
>   If you are writing an Internet Draft and you know of a patent that
>   applies to the technology you're writing about, don't list the patent
>   in the document.  Instead, send a note to the IETF Secretariat ...
>... Intellectual property rights aren't
>   mentioned in RFCs because RFCs never change after they are published,
>   but knowledge of IPR can change at any time.  Therefore, an IPR list
>   in a RFC could be incomplete and mislead the reader. ...

The reason for not including patent references is apparently to insure that
RFCs do not have out-of-date or incomplete information.  But the short
lifetime of Internet-Drafts, and the fact that they can be easily and quickly
updated at any time, would seem to warrant including specific information.
RFC 3160 refers to RFC 2026, which says nothing on this point.
Does anyone know of other reasons for not having full and complete
information in a draft?

On the subject of whether the draft includes "unsupported opinions",
At 03:23 PM 3/28/02 -0800, Tom Wu wrote:
>In my opinion, section 4.10 of that I-D, in its entirety, crosses this line and sticks out like a sore thumb.  It presents no new facts about the techniques being discussed; the math behind SPEKE is already disclosed elsewhere in the draft, while the math behind SRP is disclosed in RFC2945.  What it does do, is present the author's unsupported opinion on what techniques are similar or different to/from other techniques.  I ask that it be removed.

I think section 4.10 of the draft and reference to specific patents is
important, given the current state of awareness of these issues,
and rumors that abound.  Comparison of related techniques is essential
for an understanding of these methods, regarding patents or otherwise.
I think more specific facts, rather than less, encourages discussion and review.

If I said that I think that your opinion is unsupported, because I believe
the draft statements are supported, we could talk in circles forever.
Obviously we disagree on some things.

Nevertheless, I'll amend the draft to use simpler factual statements,
and I'll try harder to avoid statements that might be viewed
as opinions, however supported I may think they are.

-- David

---

From: David Jablon <[email-masked]>
Date: Sat, 30 Mar 2002 15:55:15 -0500

-- David