[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Questions about libntru license/ntru patent status



Hi Ian,

Sorry for having let this drift for so long. Way back at the start of the discussion, as we got into the discussion of the FOSS Exception, there seems to have been an assumption that Tor would depend on that FOSS Exception to use NTRU. In fact, our plan was to make a Tor-specific carveout along the lines of:

"The NTRU source code and patents can be freely used and distributed
when used as part of the quantum-safe-ntor protocol as specified in [doc
ref] and its successor documents designated as such by the Tor Project."

This isn't on the licensing page yet because we wanted to make sure it was acceptable to everyone before publishing it, so that's probably why we got hung up on the FOSS exception language. Does this language (or language close to it) work for Debian?

Cheers,

William




On Tue, Mar 15, 2016 at 1:49 PM, Ian Jackson <ijackson@chiark.greenend.org.uk> wrote:
William Whyte writes ("Re: Questions about libntru license/ntru patent status"):
> On the FOSS Exception,
> https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/FOSS%20Exception.md:
> the intent here is to protect the effectiveness of the GPL. As noted,
> clause 2b requires that "The Derivative Work does not include any work
> licensed under the GPL other than the GPLed NTRU". The idea of this is that
> it prevents someone from creating a Derivative Work that is simply two
> GPLed modules stuck together under a more permissive license, which would
> be possible if it were not for this clause, and which would circumvent the
> intent of the GPL.

I don't understand this concern.  To circumvent the GPL in this way
would require the consent of _all_ the copyrightholders of GPL'd
parts.

> The alternative that Ian mentioned,
> http://www.gnu.org/licenses/gpl-faq.en.html#GPLIncompatibleLibs, is more of
> a whitelist approach. If that'd be easier we can make that licensing
> statement, though I think the current FOSS exception actually covers Tor's
> requirements.

I'm not really an expert but the FSF and GNU are the originators of
the GPL and if I wanted to grant an additional permission (ie an
exceptional relaxation) of the GPL, I would use their suggested
wording.

Note that you don't need to whitelist the specific programs.  You
could abstract it to licences, writing something like this:

  Additional permission under GNU GPL version 3 section 7:
  If you modify this Program, or any covered work, by linking or
  combining it with other work(s) under Suitable Free Sofware
  licence(s) (or modified version(s) of such works), the licensors of
  this Program grant you additional permission to convey the resulting
  work.  Corresponding Source for a non-source form of such a
  combination shall include the source code for all the parts used of
  such other works used, as well as that of the covered work.

  Alternatively (regarding GNU GPL version 2): As a special exception,
  the copyright holders of NTRU give you permission to combine NTRU
  with other Free Software programs or libraries that are released
  under a Suitable Free Software licence (or modified versions of such
  other code, with unchanged license). You may copy and distribute
  such a system following the terms of the GNU GPL v2 for NTRU and the
  licenses of the other code concerned, provided that you include the
  source code of that other code when and as the GNU GPL requires
  distribution of source code.

  Note that people who make modified versions of NTRU are not
  obligated to grant either of these special exception for their
  modified versions; it is their choice whether to do so. The GNU
  General Public Licenses gives permission to release a modified
  version without these exceptions; these exceptions also make it
  possible to release a modified version which carries forward this
  exception.

  A "Suitable Free Sofware licence" is a licence in the list below:
  [include licence list]

Ian.


Reply to: