Subject: Re: [KEYPROV] Second Last Call: draft-ietf-keyprov-symmetrickeyformat (Symmetric Key Package Content Type) to Proposed Standard

From: Simon Josefsson <[email-masked]>
Date: Wed, 28 Apr 2010 21:57:48 +0200

The IESG <[email-masked]> writes:

> The IESG has received a request from the Provisioning of Symmetric Keys 
> WG (keyprov) to consider the following document:
>
> - 'Symmetric Key Package Content Type '
>    <draft-ietf-keyprov-symmetrickeyformat-08.txt> as a Proposed Standard
...
> The file can be obtained via
> http://www.ietf.org/internet-drafts/draft-ietf-keyprov-symmetrickeyformat-08.txt

This document appears to have a normative reference to a patent:

7.1. Normative References 

   [FIPS197]    National Institute of Standards.  "FIPS Pub 197: 
                Advanced Encryption Standard (AES)", 26 November 2001. 

   [LUHN]       Luhn, H., "Luhn algorithm", US Patent 2950048, August 
                1960, http://patft.uspto.gov/netacgi/nph-
                Parser?patentnumber=2950048. 

I cannot find a patent disclosure about this on file with the IETF:

https://datatracker.ietf.org/ipr/search/?option=document_search&document_search=draft-ietf-keyprov-symmetrickeyformat

I believe the authors should file a patent disclosure about this in
order to comply with the spirit of RFC 3979 section 6.1.3.

Was the patent concern discussed by the WG before the last call?  I
don't recall any discussion about this, but I may have missed it.

What is the licensing for this patent?

Use of the LUHN algorithm does not appear essential for this document,
thus I would prefer that some other non patent encumbered algorithm were
used.

/Simon

---

From: Sam Hartman <[email-masked]>
Date: Wed, 28 Apr 2010 16:12:35 -0400

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> This document appears to have a normative reference to a
    Simon> patent:

    Simon>    [LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048,
    Simon> August 1960, http://patft.uspto.gov/netacgi/nph-
    Simon> Parser?patentnumber=2950048.

    Simon> I cannot find a patent disclosure about this on file with the
    Simon> IETF:

    Simon> https://datatracker.ietf.org/ipr/search/?option=document_search&document_search=draft-ietf-keyprov-symmetrickeyformat

    Simon> I believe the authors should file a patent disclosure about
    Simon> this in order to comply with the spirit of RFC 3979 section
    Simon> 6.1.3.

Simon, I'm not sure what the letter of that BCP says, but I think the
spirit  of the requirements is that we should have disclosures regarding
any IPR that may pose concerns for implementation.

As far as I can tell, this is an August 1960 patent.  It's old enough
that no license is required.  I do not see any concerns this poses.

Am I missing something.

--Sam

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 28 Apr 2010 22:19:57 +0200

> that no license is required.  I do not see any concerns this poses.

I did not notice the date.

More worrisome, I cannot read the reference.  The link goes to a page
which says 'Full text is not available for this patent.  Click on
"Images" button above to view full patent' and when I click on "Images"
I get nothing because the page appears to require some non-standard
plugin that I don't have installed.

/Simon

---

From: Sean Turner <[email-masked]>
Date: Wed, 28 Apr 2010 16:48:41 -0400

> plugin that I don't have installed.

This is a bad reference in both this document and the one I copied it 
from, draft-ietf-keyprov-pskc.  We both need to point to something else. 
  Wikipedia says that the LUHN algorithm is in "ISO/IEC 7812-1:2006 
Identification cards - Identification of issuers - Part 1: Numbering 
system."  As soon as I can confirm this (a bunch of searches seem to 
indicate that it is in that standard), I'll update the reference to the 
ISO standard.  I'll need to check on whether we need to submit something 
about the patent - it was published in 1960.

spt

---

From: SM <[email-masked]>
Date: Thu, 29 Apr 2010 00:10:54 -0700

>I did not notice the date.

As your concern seems to be about the disclosure and not the validity 
of the patent, you could overlook the date.

>More worrisome, I cannot read the reference.  The link goes to a page

FYI 36 mentions ISO/IEC 7812-1:1993.

I note that this second Last Call is because the writeup failed to 
highlight a normative down reference to an Experimental RFC.  One of 
the questions asked before a Last Call was:

   "Has an IPR disclosure related to this document been filed? If so,
    please include a reference to the disclosure and summarize the WG
    discussion and conclusion on this issue."

The answer to that was:

   "There are no concerns with this document. No IPR disclosures have
    been field."

Given that a patent is explicitly referenced in 
draft-ietf-keyprov-symmetrickeyformat, there should have been a note 
about that.  There shouldn't have been a reference to the patent in 
the I-D.  One of the authors mentioned that it is a bad reference and 
it will be changed.

On a tangent, authors (I am not referring to any author associated 
with this draft) should be aware that they are claiming that their 
"Internet-Draft is submitted to IETF in full conformance with the 
provisions of BCP 78 and BCP 79".  Saying that there is an open 
source implementation or that other SDO didn't see any issue is not a 
disclosure.

Regards,
-sm