It’s unclear to me how these
requests relate to the OASIS legacy IPR policy (http://www.oasis-open.org/who/ipr/intellectual_property_2000-1-13.php),
which I understand as governing the treatment of intellectual property by the
TC. As far as I can see there, the policy requires acknowledgment of “major
contributors”, not exhaustive identification and enumeration of all individuals
who have been involved in review and comment on a contribution (which can often
be difficult to accomplish outside the context of organizations with defined
membership lists). Further, the policy does not appear to impose any
requirement that non-submitting contributors must be members of the TC to which
a contribution is being made.
--jl
From: Paul Cotton
[mailto:]
Sent: Thursday, September 29, 2005
2:20 PM
To: Linn, John; Anthony Nadalin;
Kelvin Lawrence
Cc:
Subject: RE: [wss] Revised WSS
OTP-Token proposal
>but have requested that OTPS participants who have been involved in
review and comment on its predecessor drafts inform us of any such claims.
Can you identify the "OTPS
participants"?
Will they be joining the TC so that they
will be covered by the same IP rules as the other existing TC members?
/paulc
From: Linn,
John [mailto:]
Sent: Wed 28/09/2005 17:11
To: Anthony Nadalin; Kelvin
Lawrence
Cc:
Subject: RE: [wss] Revised WSS
OTP-Token proposal
The RSA/OTPS document in question does not
specify a particular OTP method, but instead proposes a method-independent
profile that can be used to apply a variety of OTP methods along with
WSS. In essence, therefore, its scope is comparable to that of the proposed
work item; along with other inputs, we would hope that it would contribute
relevant work which would be useful in constructing the anticipated
deliverable.
For reference, the document is available
at ftp://ftp.rsasecurity.com/pub/otps/wss-token/wss-token-v1-0.pdf.
I don’t anticipate that further technical changes would take place before
a TC submission, though some frontmatter and administrative revisions may be made.
WRT IPR, the document states as follows (within Appendix B, Notices):
“RSA Security does not make any claims on the general
constructions described in this document. The RSA SecurID technology
implementations of time-based mode authenticator token devices, and related
validation processing components, are covered by a number of US patents (and
foreign counterparts), in particular US Patent Nos. 4,885,778; 4,856,062;
5,097,505; 5,168,520 and 5,657,388. Additional patents are pending. As
this specification can be implemented without the use of time-based mode
authentication technology, it is RSA Security’s position that the
technology covered by these patents and applications is not required to
implement this specification.”
Further, we are not currently aware of any
IP claims which others may make which would affect the general constructions as
described in this document, but have requested that OTPS participants who have
been involved in review and comment on its predecessor drafts inform us of any
such claims.
--jl
From: Anthony Nadalin
[mailto:]
Sent: Wednesday, September 28,
2005 4:05 PM
To: Kelvin Lawrence
Cc: Linn, John;
Subject: Re: [wss] Revised WSS
OTP-Token proposal
Its
still confusing as its states that "RSA Security proposes to submit a
version of this document as
"input to the WSS TC" yet as discussed it was indicated that this
effort is not about a single technology, so I would assume that the document
would be not input but referenced, much like PKI, Kerberos etc. Also if RSA
plans to really submit the document as input what would be the IPR terms ? Same
goes to Verisign ?
Anthony Nadalin | Work 512.838.0085 | Cell 512.289.4122
Kelvin
Lawrence/Austin/IBM@IBMUS
Kelvin
Lawrence/Austin/IBM@IBMUS
09/27/2005 05:39 PM
To
"Linn, John" <>
cc
Subject
Re: [wss] Revised WSS OTP-Token proposal
John and Hans, thank you for taking the time to update and re-post your
proposal.
TC Members, Now that we have a modified proposal in front of us what do people
think?
I would very much like to see some discussion here so that we can be effective
on the call on Tuesday.
Thanks to those of you that have already posted your views
Cheers
Kelvin
"Linn, John"
<> wrote on 09/27/2005 10:48:05 AM:
> Following last week's
discussion, we'd like to offer the following
> revised version of
the OTP-Token proposal for consideration by the TC:
>
> RSA Security and
VeriSign would like to propose a new work item for the
> WSS TC, defining a
WSS profile for use of One-Time Password (OTP)
> authentication.
The intended goal is to accommodate a broad range of
> OTP technologies
within the WSS framework. While conceptually similar
> to the existing
UsernameToken profile, this profile would support
> transport of
OTP-related ancillary information (e.g., PINs, challenges,
> counters, device and
algorithm identifiers) in conjunction with
> authentication
requests in order to provide comprehensive support for
> OTP methods within
the WSS/SOAP environment.
>
> We anticipate that
the profile will accommodate OTP methods including
> (but not limited to)
OATH HOTP, RACF PassTickets, RSA SecurID(r)
> authenticator token
devices, and other candidates that may be identified
> within the TC. While
IPR claims may apply to underlying OTP methods that
> the profile may
support, the proposers intend that the constructions to
> be defined in the
profile itself be unencumbered.
>
> This profile would be
functionally comparable to other profiles defined
> within the WSS TC, so
we believe it is appropriate to standardize within
> the same forum.
We propose that this activity be undertaken as a
> general TC work item,
comparable to other profiles addressed by the TC,
> rather than within a
distinct subcommittee. It is not the proposers'
> intent that this work
item be incorporated into WSS 1.1, or that it
> delay TC progress on
that release.
>
> We anticipate that
existing and related work will be available as input
> for this task.
The One-Time Password Specifications (OTPS,
> http://www.rsasecurity.com/rsalabs/otps)
> initiative,
coordinated by RSA Security, has produced an OTP-WSS-Token
> specification which
has evolved in response to public review and
> comment. RSA Security
proposes to submit a version of this document as
> input to the WSS TC.
>
> VeriSign, in
conjunction with the Open Authentication initiative (OATH,
> http://www.openauthentication.org)
is also producing work related to an
> OTP token profile.
We anticipate that versions of these input documents
> will be ready for
OASIS submission by or during October 2005. We propose
> that the results of
these efforts, along with any other inputs which may
> be received through
the OASIS process, be harmonized under WSS TC
> auspices.
>
>
> John Linn, RSA
Security
> Hans Granqvist,
VeriSign
>
>
>
>
---------------------------------------------------------------------
> To unsubscribe from
this mail list, you must leave the OASIS TC that
> generates this mail.
You may a link to this group and all your TCs in OASIS
> at:
> https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php
>
