Subject: RE: [ietf-dkim] agenda item on upgrading hash algorithms?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 23 Feb 2006 10:31:36 -0800

The point I was making here is that we do not need CertiCom to do ECC.

Certicom have a number of patents relating to ECC, the earliest of which
was filed in 1997. Practical means of performing ECC were published in
1985.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Scott Kitterman
> Sent: Thursday, February 23, 2006 12:59 PM
> To: [email-masked]
> Subject: Re: [ietf-dkim] agenda item on upgrading hash algorithms?
> 
> On 02/23/2006 12:16, Douglas Otis wrote:
> > On Feb 22, 2006, at 7:52 PM, Douglas Otis wrote:
> > > On Feb 22, 2006, at 6:47 PM, Hallam-Baker, Phillip wrote:
> > >> In rebuttal to Doug's point about not depending on the DNS 
> > >> supporting longer key sizes, an ECDSA key that gives equivalent 
> > >> strength to a 128 bit symmetric cipher is 256 bits with point 
> > >> compression and 512 bits without. An equivalent ECDSA 
> signature is
> > >> 512 bits in either case. The comparable key size for RSA is 3072 
> > >> bits for key and signature.
> > >
> > > This looks great, but at what price?  From what other companies 
> > > beyond Certicom Inc. would licenses need to be obtained 
> in order to 
> > > support the EC algorithm?  Is there any information with 
> respect to 
> > > existing terms?
> >
> > As a follow-on:
> >
> > Certicom may grant royalty free licenses in some cases.
> >
> > http://www.certicom.com/download/aid-545/IETF.pdf
> >
> > http://www1.ietf.org/ietf/IPR/IETF-2006Jan26-Certicom-IPR.pdf
> >
> > http://www.ietf.org/ietf/IPR/certicom-ipr-rfc3526-rfc2409-ikev2.txt
> >
> > http://www.ietf.org/ietf/IPR/CERTICOM-SMIME
> > http://www.ietf.org/ietf/IPR/certicom_smime_license.pdf
> >
> > http://www.ietf.org/ietf/IPR/CERTICOM-IPSEC-ECC
> >
> > http://www.ietf.org/ietf/IPR/CERTICOM-ECDSA
> >
> One of the points that DKIM currently has in its favor is 
> that it can be implemented in all major MTAs without 
> conflicting with the existing licensing of those programs 
> (both proprietary and open, including GPL).  
> 
> I think that if DKIM were to be dependent on crypto 
> technology with more restrictive licensing terms, it would 
> represent a substantial impediment to adoption.  IANAL, so I 
> have no idea if the representations above would present a 
> problem or not, but I do think that we should understand the 
> impacts of these patents on the ability of DKIM to be 
> implemented everywhere before we proceed to far towards a 
> solution with additional licensing considerations.
> 
> Scott K
> _______________________________________________
> NOTE WELL: This list operates according to 
> http://mipassoc.org/dkim/ietf-list-rules.html
> 
> 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Thu, 23 Feb 2006 12:15:40 -0800

On Feb 23, 2006, at 10:31 AM, Hallam-Baker, Phillip wrote:
>> One of the points that DKIM currently has in its favor is that it  
>> can be implemented in all major MTAs without conflicting with the  
>> existing licensing of those programs (both proprietary and open,  
>> including GPL).
>>
>> I think that if DKIM were to be dependent on crypto technology  
>> with more restrictive licensing terms, it would represent a  
>> substantial impediment to adoption.  IANAL, so I have no idea if  
>> the representations above would present a problem or not, but I do  
>> think that we should understand the impacts of these patents on  
>> the ability of DKIM to be implemented everywhere before we proceed  
>> to far towards a solution with additional licensing considerations.
>
> Certicom have a number of patents relating to ECC, the earliest of  
> which was filed in 1997. Practical means of performing ECC were  
> published in 1985.

ECC is attractive from a performance standpoint, but not without  
problems.

Quote from Certicom Inc.
http://www.certicom.com/index.php?action=ip,keygen
---
The security of public-key systems rests on keeping the private keys  
secret. Recent discoveries have revealed that the presence of a bias  
in the process of generating private keys may leak information about  
the private key into the public key. As an example, a recent attack  
on a system with a biased key-generation process obtained information  
about the private key by examining a number of signatures.  The  
attacks work against such discrete-log-based signature schemes as the  
DSA and the ECDSA. One patent protects against this attack by  
teaching methods of eliminating bias in the generation of private  
keys or per-message secrets. One such method comprises testing the  
hashed output of a random-number generator against preset criteria  
(determined by the order of the group underlying the cryptosystem).  
If the output fails the test, the pre-hashed value is modified by a  
deterministic amount, hashed, and retested until the output passes  
the test.
---

There is a good papers at:
http://www.secg.org/?action=secg,docs_draft

Certicom's extensive portfolio of patents related to elliptic-curve  
cryptography, and the extensive IPR claims affecting IETF protocols  
using the elliptic-curve algorithms seems to suggest avoiding  
Certicom may not be that easy.  Their royalty-free license, if  
granted for DKIM, does not seem overly problematic.  Certicom also  
provides a developers kit.  Is there safe elliptic-curve cryptography  
code available known to be free of any IPR restrictions?

-Doug