Re: [TLS] Document Action: 'TLS Elliptic Curve Cipher Suites with

[Dean Anderson <dean@xxxxxxx>]

On Wed, 2 Jul 2008, Steven M. Bellovin wrote:
> 
> Sure.  The question is how to coerce companies that don't participate
> into doing so.

We don't need to coerce non-participants to be reasonably effective.  
We just need to make sure that participants comply with RFC3979.

There are only two cases the IETF can fix:

  1. The IETF partipicant directly has an undisclosed patent.

  2. A non-participant has a patent that an IETF participant knows of,
but doesn't disclose. (e.g. Housley/Brown and TLS-Authz)

Both these cases are handled by rescinding the RFC for failure to follow
RFC3979. And of course, these bad participants are discredited in future
IETF activities---The web is a wonderful thing for a implementing a
certain level of accountability.

IETF Standards are only created by participants.  Quite obviously,
non-participants do not create IETF standards. Big company-participants
are strongly motivated not to implement technology that someone else has
patented---At least, not without factoring the license cost into the
business plan.  Those big participants therefore help make sure the
other participants are honest, and that patent disclosures are made on a 
timely basis.

The case where a non-participant has a patent that no IETF participant
knows about is still a problem, but these are truly submarine patents
that NO ONE can avoid. Except of course, by changing the patent law.

The case where a participant knows of a patent, and willfully misleads
the IETF about the patent status [with or without a profit motive] is
just a subset of (2) above.

		--Dean




-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   


_______________________________________________
TLS mailing list
TLS@xxxxxxxx
https://www.ietf.org/mailman/listinfo/tls