Subject: Re: [pkix] IPR status for ECDH and ECDSA

From: "Henry B. Hotz" <[email-masked]>
Date: Fri, 1 Oct 2010 18:04:08 -0700

That's a more specific body of law than the general laches principal.  Laches could be a very useful defense against an IPR claim, but it's not terribly specific, so I'd be timid about relying on it.

On Aug 9, 2010, at 7:28 AM, Miller, Timothy J. wrote:

> IIRC, a failure to enforce resulting in the forfeiture of IP rights only applies to trademarks, service marks, and trade secrets (under US law).  But since IANAL either, this probably is wrong.  :)
> 
> -- Tim
> 
> 
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On Behalf Of
>> Michael StJohns
>> Sent: Sunday, August 08, 2010 1:31 PM
>> To: Anders Rundgren; Todd E. Johnson
>> Cc: [email-masked]
>> Subject: Re: [pkix] IPR status for ECDH and ECDSA
>> 
>> A completely lay opinion with no legal basis.
>> 
>> Stay away from point compression, binary (F2m) curves and ECMQV and
>> you've probably avoided most mine fields.
>> 
>> With respect to the smart card implementation - the IPR of the smart
>> card is basically not your problem - you have to ask the card provider
>> what they've done in the space and whether or not they'll indemnify you
>> and from what I can tell, most will.  Either because they bought a
>> license from Certicom or because their lawyers have done the IPR
>> analysis.
>> 
>> With respect to OpenSSL and BouncyCastle - well, there's sort of this
>> principle in law called laches which says that failure to assert your
>> rights in patents in a timely manner tends to void your ability to claim
>> infringement or to enforce a claim of infringement.  I note without
>> further comment that both OpenSSl and BouncyCastle have had EC suites
>> for quite a while and that the OpenSSL EC was built by Sun in a manner
>> intended to be non-infringing.
>> 
>> Mike
>> 
>> 
>> 
>> At 01:26 PM 8/8/2010, Anders Rundgren wrote:
>>> Thank for the pointers Todd!
>>> 
>>> My hope (and uneducated guess) is that
>>> 
>>>       http://en.wikipedia.org/wiki/Moore's_law
>>> 
>>> effectively vaporizes RIM/Certicom IPR which is very much
>>> based on realizing public key cryptography in computationally
>>> weak devices.
>>> 
>>> A state-of-the-art 100 Mhz 32-bit ARM device with 64K RAM and
>>> 256K ROM should be able to use less-than-optimal algorithms.
>>> 
>>> Anyway, it would be awfully nice to get some truly authoritative
>>> input on this matter although I understand that in the end the
>>> validity of patents and violations is primarily a legal issue.
>>> IANAL. The deeper your pockets are, the better it gets :-)
>>> 
>>> Associated question: if you put NIST suite B in standard electronics
>>> devices like USB memory sticks, will you violate the Wassenaar
>>> agreements in spite of the fact that anybody can build such devices?
>>> 
>>> Anders
>>> 
>>> On 2010-08-08 16:04, Todd E. Johnson wrote:
>>>> Hi Anders,
>>>> 
>>>> I am highly interested in a response on this as well.
>>>> 
>>>> For example, there is a document at secg.org by Certicom which
>> provides
>>>> some coverage of Certicom patents (although a bit dated):
>>>> 
>>>> http://www.secg.org/download/aid-398/certicom_patent_letter_SECG.pdf
>>>> 
>>>> Which seem it was compelled by the SECG Patent Policy:
>>>> 
>>>> http://www.secg.org/index.php?action=secg,about_patents
>>>> 
>>>> Funny thing is, I am generally unaware of any implementations based
>> on
>>>> SECG standards, yet I am certainly no authority in this field...
>>>> 
>>>> On 08/07/2010 04:58 AM, Anders Rundgren wrote:
>>>>>  I'm plotting with a smart card concept where ECC is a corner-stone
>>>>> with NIST's SP800-56A C(2, 0, ECC CDH) algorithm as a prerequisite
>>>>> for creating a shared session-key using two  ephemeral keys.
>>>>> 
>>>>> Although RIM/Certicom presumable offers RAND terms it is pretty hard
>>>>> to know what that means in practice and even how it is supposed to
>> be
>>>>> controlled since the concept is based on Open Hardware and Open
>> Software
>>>>> which means that production could happen anywhere, like in China.
>>>>> 
>>>>> Is my assumption correct that ECDSA and ECDH are IPR-free but that
>>>>> some implementations are not?  Is it known if OpenSSL's or
>> BouncyCastle's
>>>>> implementations violate RIM/Certiticom IPR?  I would be nice if they
>>>>> don't since the design heavily builds on their work as well.
>>>>> 
>>>>> Anders
>>>>> _______________________________________________
>>>>> pkix mailing list
>>>>> [email-masked]
>>>>> https://www.ietf.org/mailman/listinfo/pkix
>>>>> 
>>>> 
>>> 
>>> _______________________________________________
>>> pkix mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/pkix
>> 
>> 
>> _______________________________________________
>> pkix mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/pkix
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]