On 9/23/2021 12:10, Alec Warner wrote: > On Wed, Sep 22, 2021 at 10:54 PM Joshua Kinard <ku...@gentoo.org> wrote: >> >> On 9/22/2021 12:37, Robin H. Johnson wrote: >>> On Wed, Sep 22, 2021 at 08:54:40AM -0400, Joshua Kinard wrote: >>>> Is there any advice on how this impacts net-misc/dropbear? That has ECC >>>> (both ECDSA and Ed25519) support, and I use it for SGI/MIPS netboot images. >>>> The build doesn't have any bindist uses in it, and ECC support is a >>>> localoptions.h compile-time option (enabled by default). ECC is much >>>> faster >>>> on old SGI hardware and generating the hostkeys at bootup takes just a >>>> second or two, whereas RSA can take up to 10-15 seconds. So I'd like to be >>>> able to use ECC on these platforms and distribute netboot images using >>>> them. >>> RedHat doesn't seem to disable ECC in Dropbear: >>> https://src.fedoraproject.org/rpms/dropbear/blob/rawhide/f/dropbear.spec >>> >>> Based on what they've said for OpenSSL, I would expect that they SHOULD >>> have disabled ECC there, but there is certainly no consistency from >>> them. >>> >>> Probably nobody asked legal and just shipped dropbear anyway. >>> >>> If you wanted to stir the pot, you could post to the Fedora legal list >>> and ask for consistency ;-). >> >> Hmm, it looks like dropbear is relying heavily on the ecc/ecdsa functions >> provided in libtomcrypt, and that library's homepage states all its code is >> public domain. Our ebuild has no bindist restrictions on that library. >> Perhaps that is how dropbear, and thus Red Hat, avoids the issues with >> licensing or patents? > > I don't see a patent grant in the unlicense; so I don't see how this > works around that problem. Now it's hard for us to say (because we > don't know what patents openssl might contain, to be able to look at > dropbear and compare.) > Note that openssl 3.0 is released under a new license (The Apache 2.0 > license) which has a patent grant in it. Note that the grant itself is > not bulletproof, but it's often better than nothing. > > The apache 2.0 grant basically says if the patent author writes the > code and submits it as apache 2.0 they grant you a license to do a > bunch of stuff with the code. If I'm just some individual who writes > the patented code and I license it as apache 2.0; obviously I have no > right to grant you a patent license....so the grant in apache2 is not > useful in that context. In the latter case I'd expect the project to > remove the code in question in most circumstances. > > In general we trust upstream (because we have no other option.) If we > become aware that there is patented material in a package we should > take the requisite action (typically restrict=bindist) so that we are > not violating the patents (and we did that for openssl, for example.) > I want to get away from this concept that we can easily tell whether > something is protected or not, or contains patents or not; it's a hard > problem. In many cases its similar to licensing. We trust upstream > until we learn otherwise and then we endeavour to fix the issue. > Sometimes that means removing code; or changing the LICENSE variables, > etc. > > -A
If I remember this weekend, I'll e-mail the libtomcrypt author and see if they have any insight. One would hope they did their own research before possibly putting patented code out into the public domain. Any idea if the Ed25519 forms are unencumbered? As far as I know, those were developed by DJB completely independent of ECDSA, so it seems like those should be fine. -- Joshua Kinard Gentoo/MIPS ku...@gentoo.org rsa6144/5C63F4E3F5C6C943 2015-04-27 177C 1972 1FB8 F254 BAD0 3E72 5C63 F4E3 F5C6 C943 "The past tempts us, the present confuses us, the future frightens us. And our lives slip away, moment by moment, lost in that vast, terrible in-between." --Emperor Turhan, Centauri Republic
