Mailing-List: contact dev-help@harmony.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@harmony.apache.org
Received-SPF: pass (nike.apache.org: domain of t.p.ellison@gmail.com
 designates 66.249.92.169 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:x-enigmail-version:content-type:content-transfer-encoding;
        b=tudLnljF/hgqEgyFrvlmDl4bvvzTVmRIgUP20565mLUM3ZuICLyzVyN3iNMVrsotqWWgw5qhVvLyfATOBokThgbT/NRMS1NJRqSCjzWFz+CDg2LWmxxRIPsMwtehC/QF0dJpp9oRfT4vjkaG6m0mKRzYFNU49/R5VpwFRiN+e+A=
Message-ID: <46EFBC4A.2000008@gmail.com>
Date: Tue, 18 Sep 2007 12:53:46 +0100
From: Tim Ellison <t.p.ellison@gmail.com>
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: dev@harmony.apache.org
Subject: Re: [classlib] Redistributing bouncy castle providers
References: <46EFA342.7050801@gmail.com>
	 <906dd82e0709180410w7afd842fpf1e5adc5e8ce7c3e@mail.gmail.com>
	 <46EFB5E3.60102@gmail.com>
 <906dd82e0709180437s3ea5ef45l37950588558560d0@mail.gmail.com>
In-Reply-To: <906dd82e0709180437s3ea5ef45l37950588558560d0@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Mikhail Loenko wrote:
> I think it's OK to keep it. It's written according to
> http://www.ietf.org/rfc/rfc2246.txt

Depends what you mean by "it".  I agree that its ok for us to keep the
references to the algorithm, but we should not be redistributing the
implementation of the algorithm.

Regards,
Tim


> 2007/9/18, Tim Ellison <t.p.ellison@gmail.com>:
>> Mikhail Loenko wrote:
>>> 2007/9/18, Tim Ellison <t.p.ellison@gmail.com>:
>>>> There is a discussion over at the incubator general mailing list (e.g.
>>>> [1]), amongst other places, about the redistribution of BouncyCastle
>>>> code from ASF machines.
>>>>
>>>> The crux is that we can't redistribute BC's IDEA implementation as it is
>>>> subject to a known patent for which we don't have a grant/license.
>>>>
>>>> We'll have to change our current practice of publishing binaries that
>>>> include BC unmodified.  The resolution seems to be maintaining a local
>>>> copy of the BC JAR without the offending algorithm.  I expect we would
>>>> have to unsign the JAR too when modified.
>>>>
>>>> Do we have any dependencies upon IDEA?  I see some references in the
>>>> JSSE cipher suite code,
>>> Reference to IDEA?
>> just grepping:
>>
>> modules/x-net/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
>> 107:    static byte[] code_TLS_RSA_WITH_IDEA_CBC_SHA = { 0x00, 0x07 };
>> 157:    static CipherSuite TLS_RSA_WITH_IDEA_CBC_SHA = new CipherSuite(
>> 158:            "TLS_RSA_WITH_IDEA_CBC_SHA", false, KeyExchange_RSA,
>> "IDEA_CBC",
>> 159:            "SHA", code_TLS_RSA_WITH_IDEA_CBC_SHA);
>> 256:            TLS_RSA_WITH_IDEA_CBC_SHA,
>> 417:        } else if ("IDEA_CBC".equals(cipherName)) {
>> 418:            this.cipherName = "IDEA/CBC/NoPadding";
>>
>>
>> Regards,
>> Tim
>>
>