Re: [TLS] Document Action: 'TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode' to Informational RFC

[Dean Anderson <dean@xxxxxxx>]

On Fri, 27 Jun 2008, Eric Rescorla wrote:

> 
> This paragraph only refers to documents which did not go through
> the IETF process, as implied by the first sentence of 4.2.3.

Indeed. And this document indeed did not properly follow the IETF
process because it did not disclose IPR in accordance with RFC3979 and
because it did not discuss non-patented alternatives, also in accordance
with RFC3979.  The intent of 4.2.3 is to prevent the circumvention of
the rules, and the IETF rules are not being followed.

>    Unless they are the result of IETF Working Group action, documents
>    intended to be published with Experimental or Informational status
>    should be submitted directly to the RFC Editor.
> 
> This document was a TLS WG document, so had already been
> coordinated with the IETF community.

That is precisely the point: it has NOT been properly coordinated with
the internet community: Not all the pertinent facts were disclosed to
the internet community.  

I think the recent events surrounding TLS-Authz at least indicate that
the internet community is keenly interested in facts of patent
encumbrance. These facts were apparently known to IESG managers and
those managers also knew these facts would be important to the
community, but kept the community in the dark, made false 
representations in the draft, and failed to follow IETF policy.

The following paragraph in the 'ecc-new-mac draft is a false
representation:

   By submitting this Internet-Draft, each author represents that any
   applicable patent or other IPR claims of which he or she is aware
   have been or will be disclosed, and any of which he or she becomes
   aware will be disclosed, in accordance with Section 6 of BCP 79.

What was claimed to be an innocent mistake in TLS-Authz cannot be
repeated by essentially the same people and still be considered an
innocent mistake.  Twice is not a mistake. Especially after all the fuss
that was made about TLS-Authz.


		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   


_______________________________________________
TLS mailing list
TLS@xxxxxxxx
https://www.ietf.org/mailman/listinfo/tls