Rob Stradling wrote:
Frank, I'm pretty sure you meant to say Certicom (who are now owned by RIM)
rather than Entrust. (Perhaps you were thinking of Entrust's CRL Distribution
Points patent, a license for which was granted to Mozilla relatively
recently?)
D'oh! You are correct, I was thinking of Entrust and CRLDP. As far as I
can tell the inclusion of ECC into NSS was based on NSS implementing
non-patented ECC techniques.
Certicom have said that their desire is "to facilitate the wide-scale adoption
and proliferation of Elliptic Curve Cryptography (ECC) technology" and that
they "will, upon request, provide a nonexclusive, royalty free patent license,
to manufacturers to permit end users (including both client and server sides),
to use the patents..."
https://datatracker.ietf.org/ipr/1154/
http://www.certicom.com/images/pdfs/certicom%20-ipr-contribution-to-
ietfsept08.pdf
I hadn't seen these documents previously. Note that they date from after
the implementation of ECC functionality in NSS, which I believe was done
in 2006 in the Firefox 2 timeframe.
Does anybody know if Mozilla/NSS has actually requested and obtained a
nonexclusive, royalty free patent license from Certicom/RIM?
To my knowledge Mozilla has not; I can't speak for Sun or Red Hat.
Note that the general problem with these licenses is that they typically
apply only to the original licensee (e.g., Mozilla, if we were to get a
license) and don't in and of themselves permit downstream licensees of
the open source code to practice the patent themselves with respect to
derivative works of the open source code. This is a major obstacle with
respect to using such patents in open source products. I'm not a lawyer,
but I strongly suspect that the current form of the Certicom license
would be judged incompatible with the patent grant language in the MPL,
GPL, and LGPL.
If so, the near-term chances of our being able to use such patents in
the context of NSS is slim to none. We may have to wait until the
patents expire or until Certicom further loosens the license language
(which depends on its own business interests, of course).
Frank
--
Frank Hecker
hec...@mozillafoundation.org
--
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
