Subject: [CFRG] Second Call for adoption for draft-mattsson-cfrg-det-sigs-with-noise

From: Alexey Melnikov <[email-masked]>
Date: Fri, 8 Apr 2022 14:11:57 +0100

Dear CFRG participants,

This email commences a 2-week call for adoption for "Deterministic ECDSA 
and EdDSA Signatures with Additional Randomness" draft 
(draft-mattsson-cfrg-det-sigs-with-noise) that will end on April 22nd 2022:
https://datatracker.ietf.org/doc/draft-mattsson-cfrg-det-sigs-with-noise/

Diring the first CFRG adoption call CFRG chairs were made aware of the 
third party IPR that might be related to this document: 
<https://patents.google.com/patent/US9621525B2/en>. Please consider this 
in your decision to recommend adopting or not adopting this document.

Please give your views on whether this document should be adopted as a 
CFRG draft, and if so, whether you'd be willing to help work on 
it/review it.

Please reply to this email (or in exceptional circumstances you can 
email CFRG chairs directly at [email-masked]).

Thank you,
Alexey (for the chairs)

---

From: Taylor R Campbell <[email-masked]>
Date: Fri, 8 Apr 2022 14:05:21 +0000

> Date: Fri, 8 Apr 2022 14:11:57 +0100
> From: Alexey Melnikov <[email-masked]>
> 

CFRG should not adopt this draft because it does not have
deterministic known-answer test vectors that applications could use in
self-tests to verify implementations as black boxes.

Any document CFRG adopts that specifies a particular algorithm should
have deterministic known-answer test vectors fit for verification by
an application using the algorithm as a library.

This applies even if one of the inputs to the algorithm is supposed to
be randomized: the algorithm itself is a deterministic function of the
additional randomization input, and it is critical to verify that an
implementation computes the correct function of that additional
randomization input, not, e.g., another function that passes signature
verification but hashes an all-zero key in instead of the private key.

Failing to adhere to this rule exposes applications to a serious class
of attacks that have been carried out in the real world, which Ed25519
was designed to thwart.  It would be a mistake to regress to that.

I'd be happy to review changes and independently verify test vectors
in a new draft.

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Fri, 8 Apr 2022 14:06:52 +0000

Unless the IPR holder explicitly designates the patent Royalty-free, I recommend against adopting this draft - because of the IPR entanglement.

-- 
V/R,
Uri

On 4/8/22, 09:12, "CFRG on behalf of Alexey Melnikov" <[email-masked] on behalf of [email-masked]> wrote:

    Dear CFRG participants,

    Thank you,
    Alexey (for the chairs)

    _______________________________________________
    CFRG mailing list
    [email-masked]
    https://www.irtf.org/mailman/listinfo/cfrg

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 8 Apr 2022 15:13:40 +0100

On 08/04/2022 15:06, Blumenthal, Uri - 0553 - MITLL wrote:
> Unless the IPR holder explicitly designates the patent Royalty-free,
> I recommend against adopting this draft - because of the IPR
> entanglement.

FWIW, when I follow at the IPR link it says "Status
Expired - Fee Related" for the US one, and the EP one
says "Status Withdrawn" but as IANAL I don't know how
good that news might be. Be great if someone were able
to explain those statuses, even if only in the abstract
and not related to that filing.

Cheers,
S.

> 
> 
> _______________________________________________ CFRG mailing list 
> [email-masked] https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Fri, 8 Apr 2022 15:10:05 +0000

>    and not related to that filing.

(IANAL)^2, but the latest statement in the status blob says "2034 - Adjusted Expiration". That makes me suspect that the required fee was paid eventually, and the patent lifetime was extended. :-(

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 8 Apr 2022 15:25:55 +0000

> blob says "2034 - Adjusted Expiration". That makes me suspect that the required fee was paid eventually, and the patent lifetime was extended. :-(

Gee whiz, don't guess.

IETF policy is that as long as IPR declarations are filed, work can be done if the WG wants.  What is the IRTF policy?

FWIW, I kinda know the inventor and I sent him email.

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Fri, 8 Apr 2022 16:07:21 +0000

On 4/8/22, 11:27, "CFRG on behalf of Salz, Rich" <[email-masked] on behalf of rsalz=[email-masked]> wrote:

> > blob says "2034 - Adjusted Expiration". That makes me suspect that the required
> > fee was paid eventually, and the patent lifetime was extended. :-(
>
> Gee whiz, don't guess.

???

> IETF policy is that as long as IPR declarations are filed, work can be
> done if the WG wants.  What is the IRTF policy?

This is not about the policy - it's about strong or otherwise preferences/opinions of the WG members.

And my opinion - as a WG member - is that this draft should not be accepted, regardless of whether policies would or would not allow it.

> FWIW, I kinda know the inventor and I sent him email.

Excellent. You might want to encourage him to post here.

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 11 Apr 2022 20:04:30 +0000

and EdDSA Signatures with Additional Randomness" draft 
    (draft-mattsson-cfrg-det-sigs-with-noise) that will end on April 22nd 2022

    third party IPR that might be related to this document: 
    	https://patents.google.com/patent/US9621525B2/en
    Please consider this 
    in your decision to recommend adopting or not adopting this document.

I emailed Billy, the inventor. He said this is one of more than a dozen patents for his former employer, Qualcomm, and he has no idea if/why it would be treated any differently. In particular, he didn't receive any notice that they were abandoning it. He's not sure that he would have, however.

If someone wants to pursue this further, the next stop would probably be Qualcomm licensing.

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Mon, 11 Apr 2022 20:16:52 +0000

> > During the first CFRG adoption call CFRG chairs were made aware of the u
> > Please consider this in your decision to recommend adopting
> > or not adopting this document.
>
> I emailed Billy, the inventor. He said this is one of more than a dozen
> patents for his former employer, Qualcomm,

Applicable to this draft? If not - why is that relevant?

> and he has no idea if/why it would be treated any differently.

Differently from what? IETF traditionally did not like IPR, though did not forbid it. In general, IPR-encumbered drafts more often tend to be rejected than accepted.

> In particular, he didn't receive any notice that they were abandoning it.
> He's not sure that he would have, however.

If his company is the patent holder - then no, most likely Qualcomm won't notify him.

> If someone wants to pursue this further, the next stop would probably be Qualcomm licensing.

My opinion is that this RG does not need to accept this draft.

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 11 Apr 2022 20:43:21 +0000

Sorry I was not clear.

Billy has done more than a dozen patents for Qualcomm -- not all related to this draft -- and he doesn't know why this one patent would be treated any differently from the others he's done for his former employer.

Just trying to help people make a more informed decision about the call for adoption.

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Mon, 11 Apr 2022 21:10:32 +0000

On 4/11/22, 16:44, "Salz, Rich" <[email-masked]> wrote:

> Sorry I was not clear.
>
> Billy has done more than a dozen patents for Qualcomm -- not
> all related to this draft -- and he doesn't know why this one
> patent would be treated any differently from the others he's
> done for his former employer.

I understand this as "whatever patents Billy has with Qualcomm - including the one(s) relevant to this draft - Qualcomm will likely treat them like all the other patents it holds". 

> about the call for adoption.

Thank you!

I haven't checked, but as I (vaguely) recall, Qualcomm does not release its patents to Public Domain, as they are one of its revenue sources. Which strengthens my opinion that it's better to avoid this draft.

If I'm wrong about Qualcomm patent policy - please feel free to correct me with facts. I'm basing what I said on my distant recollection of working with 3GPP.