XML Security Patent Advisory Group Charter (ECC PAG)

This charter is written in accordance with the W3C Patent Policy (PP).

Table of Contents

• 1 Goals
• 2 Scope
• 3 Deliverable
• 4 Duration
• 5 Confidentiality
• 6 Participation, meetings, and logistics
  • 6.1 Participation
  • 6.2 Communications
  • 6.3 Group home page
  • 6.4 Meetings
• 7 About this charter

1 Goals

The XML Security Patent Advisory Group is a Patent Advisory Group (PAG) as defined by the W3C Patent Policy (PP).

The mission of this Patent Advisory Group is to study issues and propose solutions related to XML Encryption 1.1 and XML Signature 1.1. Both specifications normatively reference RFC 6090, as a specification for mandatory to implement algorithms. Two disclosures have been filed against an Internet-Draft for that RFC 6090.

Patents disclosed so far:

• Disclosed to IETF: 6,704,870 Digital signatures on a Smartcard that contains a description of elliptic curve algorithms
• Disclosed to IETF: 7,215,773 Key validation scheme The invention provides for the additional step of verifying the public key conform to the arithmetic properties dictated by the requirements of the selected algorithm.
• Disclosed to XML Security WG: 6,563,928 Strengthened public key protocol

This PAG is triggered by Section 7.1 (PAG Formation) of the Patent Policy, which states that a PAG is triggered in the event “a patent has been disclosed that may be essential, but is not available under W3C Royalty-Free licensing requirements”. Informal negotiations have been undertaken between the XML Security Working Group and Research in Motion and its subsidiary Certicom, who allegedly hold patents on the ECDSA and ECDH algorithms described by RFC 6090 and mandated by the XML Signature and Encryption 1.1 specifications. Those negotiations resulted in a public patent commitment by Certicom that does not satisfy the W3C RF licensing requirements. 

2 Scope

The ECC PAG has the scope to:

• Adress a direct disclosure request according to section 6.3 of the Patent Policy to Research in Motion and its subsidiary Certicom
• seek prior art that may apply to the ECDH and ECDSA algorithms
• discuss ways to design around the mandatory inclusion of the ECDH and ECDSA algorithms
• explore ways to improve the RF licensing commitment of Research in Motion and its subsidiary Certicom so that the W3C RF Patent Policy Requirements are met.
• write a PAG report with recommendations for the W3C Director
• if necessary, request an analysis by a W3C patent counsel of the claim. This analysis will only be made if there are sufficient funds for that purpose be made available via the Web Legal Support Fund. Legal analysis could only begin after sufficient commitment of additional funds to support the work.

3 Deliverable

The PAG ends with a PAG report to the W3C Director containing a recommendation. The recommendations have to be chosen among the options in section 7.5 of the Patent Policy:

1. The initial concern has been resolved, enabling the Working Group to continue.
2. The Working Group should be instructed to consider designing around the identified claims including removing ECDH from the mandatory algorithms.
3. The Team should seek further information and evaluation, including and not limited to evaluation of the patents in question or the terms under which W3C RF licensing requirements may be met.
4. The Working Group should be terminated.
5. The Recommendation (if it has already been issued) should be rescinded.
6. Alternative licensing terms should be considered. The procedure in section 7.5.3 must be followed.

4 Duration

The XML Security PAG is chartered through 31 August 2011. The PAG can be extended by the Director.

5 Confidentiality

All communications of the XML Security PAG, the mailing list archives and the minutes of telephone conferences are W3C Member confidential.

This charter, the PAG report to the Director as well as an eventual document on prior art will be public. At regular intervals, the PAG should also provide status updates to the public.

6 Participation, meetings, and logistics

6.1 Participation

In accordance with section 7.3 of the W3C Patent Policy, this PAG is composed of:

Advisory Committee Representatives of each Member participating in the XML Security Working Group

A full list of Members participating in the XML Security Working Group is available.

W3C Team contacts for the Web Applications Working Group

W3C Technology and Society Domain Leader

Thomas Roessler

W3C counsel and PAG Chair

Rigo Wenning

Chair of the XML Security Working Group

Frederick Hirsch

Others suggested by the Working Group Chairs and/or the Team with the approval of the Director

Advisory Committee Representatives of Members participating in the Web Applications Working Group must register for the PAG or will be put on the PAG by the Team. An Advisory Committee Representative who is unable to participate should designate an alternate. Each Advisory Committee Representative may also designate a second individual (usually legal counsel) to participate in the PAG.

XML Security PAG participation (attending meetings, following the mailing list) is expected to require half a day per week per participant.

6.2 Communications

The XML Security PAG conducts its discussion on a member readable mailing list, member-xmlsec-pag@w3.org (with member-visible archive).

6.3 Group home page

The ECC PAG has a member accessible and a public home page.

6.4 Meetings

The ECC PAG conducts its work through mailing-list discussions and teleconferences. The PAG can decide to have one face-to-face meeting.

Participation in teleconferences or face-to-face meetings is limited to the participants of the PAG as described by the Patent Policy. The chair may invite individuals to specific meetings at his discretion.

7 About this charter

This PAG charter has been drafted according to the Procedures for Launching and Operating a Patent Advisory Group (PAG).