Re: A replacement for the CRAM-MD5?

From: David Jablon (dpj_at_world.std.com)
Date: 02/15/04 

Date: 15 Feb 2004 10:21:45 -0800

For what it's worth, my reading of the Phoenix IPR letter is that they
don't really know the answer to David Black's question.

Some people have decided that they can use SRP for free. Others use
it for free despite possible doubts. Some pay to use alternative
equivalent methods, and, again, some use them for free, one way or
another.

I'll also note that the SPEKE methods can be used for free everyhere
in the world except the USA, and with some assurance for RAND terms
otherwise.

-- David

__________________________
David Jablon
CTO, Phoenix Technologies

Michael Amling <nospam@nospam.com> wrote in message news:<LsRRb.5440$BA2.716@newssvr26.news.prodigy.com>...
> marcel@is.titech.ac.jp wrote:
> > I have to correct myself :-) I just discovered
> > that SRP was not included in the IETF SASL
> > because of an IPC claim:
> > http://www.ietf.org/ietf/IPR/PHOENIX-SRP-RFC2945.txt
> > Thanks to a patent issue, the SASl will be less secure :-(
>
> How does the patent (number 6,226,383) referred to above relate to
> the patent (number 6,539,479) at
> http://stanfordtech.stanford.edu/4DCGI/docket?docket=97-006, (for
> SRP-3)? Stanford is giving away free licenses for client authentication
> using 6,539,479.
>
> --Mike Amling