Re: Licensing question

["David A. Cooper" <david.cooper@nist.gov>]

Bishakha Banerjee wrote:

> I would like to know the licensing issues involved in the 
> redistribution of this test suite (if this test suite were to be 
> checked into open source software?).
>
Bishakha,

The PKITS test suite was developed with the hope that it would 
facilitate the testing of path validation implementations and thus lead 
to an improvement in the quality of code that is in use.  So, we are in 
support of any use of the test suite that furthers this goal.

I would like to add one caveat, however.  As you may have seen on the 
mail list, NIST intends to reference this test suite in a Protection 
Profile that will be used to as the basis for testing of PKI clients by 
third-party laboratories.  So, I would ask that if you make any changes 
to the test suite that you make it clear that changes have been made so 
that there would be no confusion between the modified version and the 
version that will be referenced by the Protection Profile.

Until I received your message, I hadn't really given any thought to 
ownership issues, which would be a prerequisite to addressing licensing 
issues.

The test document and data were jointly developed by NIST and 
DigitalNet.  Any contribution made to this project by NIST is covered by 
Title 17 Section 105 of the United States Code which states that any 
work developed by the United State Government is not subject to 
copyright protection (see 
http://www4.law.cornell.edu/uscode/17/105.html).  So, NIST's 
contributions to the test documentation and data are in the public domain.

While DigitalNet's contributions to the documentation and data may be 
subject to copyright, all of the work done by DigitalNet on this project 
was done under contract for NSA.  So, it would be up to NSA to decide 
how DigitalNet's contributions to the project could be used.  In 
response to your query, I asked DigitalNet about the use of the test 
suite and received the following response:

    "V51 [of NSA] approved of the public release of the PKITS test data 
and documents.  There are no restrictions regarding their redistribution."


Please let me know if you need any more information.

Dave