Our product has adopted the latest version of aspose libraries. Latest Aspose 19.7 version bundles upgraded Bouncy Castle version 1.60.
Bouncy Castle upgrade was necessary to address list of Security vulnerabilities in older versions.
Upgraded Bouncy Castle version mentions patents without enough information for our legals to investigate and make decision.
Here is the required info from our legal team.
First mentioned link https://datatracker.ietf.org/ipr/1485/
Section III. IETF Document or Other Contribution to Which this IPR Disclosure Relates
No patent numbers are mentioned, we cannot be sure what platens are covered
Section IV. Licensing Declaration
License declaration section is empty.
In general, no clear information who covers what.
Second mentioned link https://datatracker.ietf.org/ipr/695/
Section IV. Licensing Declaration
Section says “Certicom will, upon request, provide a nonexclusive, royalty free patent license…” was this license ever requested by Aspose?
If you want/need, you can also view info about file (in Bouncy Castle package) where patents were mentioned:
In specifications.html following concerning text was
<h2>2.0 Patents</h2>
<p>
Some of the algorithms in the Bouncy Castle APIs are patented in some
places. It is upon the user of the library to be aware of what the
legal situation is in their own situation, however we have been asked
to specifically mention the patents below, in the following terms, at
the request of the patent holder.
<p>
The BC distribution contains implementations of EC MQV as described in RFC 5753, "Use of ECC Algorithms in CMS". In line with the conditions in:
<pre>
<a href="http://www.ietf.org/ietf-ftp/IPR/certicom-ipr-rfc-5753.pdf">http://www.ietf.org/ietf-ftp/IPR/certicom-ipr-rfc-5753.pdf</a>
</pre>
We state, where EC MQV has not otherwise been disabled or removed:</br />
“The use of this product or service is subject to the reasonable, non-discriminatory terms in the Intellectual Property Rights (IPR) Disclosures of Certicom Corp. at the IETF for Use of Elliptic Curve Cryptography (ECC) Algorithms in Cryptographic Message Syntax (CMS) implemented in the product or service.”
Can Aspose team give some clarification, if it is still ok to include the latest Aspose version?
Regards,
Akash Srivastava