DSA2

[John Clizbe]

Ryan Malayter wrote:
> On 9/24/06, Qed <qed at tiscali.it> wrote:
>> I haven't seen much traffic on ietf-openpg mailing list about this
>> issue, maybe the last message about ECC was in 2001.
>> ECC is not a priority task for RCF2440, do you think this statement is
>> more acceptable?

There were a couple messages last year on the [cryptography] mailing list wrt
ECC and patents:

   http://www.mail-archive.com/cryptography@metzdowd.com/msg04965.html
   http://www.mail-archive.com/cryptography@metzdowd.com/msg04970.html

> As far as I know, Certicom and others control many patents related to
> ECC in the USA, Canada, and several other jurisdictions. Which is
> probably why there is no effort to add these to an "open standard"
> such as PGP that might then be patent-encumbered.

Patents are a major roadblock to ECC's wider acceptance. Even the NSA opted to
avoid any patent-related problems by licensing 26 MQV-based ECC patents from
Certicom in a US$25 million deal. According to the NSA's web site:

  "Despite the many advantages of elliptic curves and despite the adoption of
   elliptic curves by many users, many vendors and academics view the
   intellectual property environment surrounding elliptic curves as a major
   roadblock to their implementation and use. Various aspects of elliptic curve
   cryptography have been patented by a variety of people and companies around
   the world. Notably the Canadian company, Certicom Inc. holds over 130 patents
   related to elliptic curves and public key cryptography in general."
      - http://www.nsa.gov/ia/industry/crypto_elliptic_curve.cfm

> The OpenSSL project recently added ECC to its portfolio of algorithms,
> though, so someone must have done the investigatory work to determine
> that the OpenSSL implementation was not patented.

Actually the ECC code in OpenSSL was supplied by Sun and is patented by Sun. Sun
contributed the code in 2002, but it was not made part of OpenSSL until 2005, as
part of OpenSSL 0.9.8. On the patented code, Sun says:

   Q7: What about the patented technology in the contributed code?

   Sun acknowledges that it has some patented ECC technology in the contributed
   code.

   Sun grants to OpenSSL users the right to make use of the contributed patented
   technology in the context of OpenSSL.

   Sun does not intend to assert its patent rights associated with the code that
   was delivered to the OpenSSL project. Sun simply asks that anyone holding
   patents associated with the same code agree not to assert them against Sun in
   return.

   Sun does not forbid people from using the donated code on the basis of
   whether or not they make this promise.
      - http://research.sun.com/projects/crypto/FrequenlyAskedQuestions.html

-- 
John P. Clizbe                   Inet:   JPClizbe(a)comcast DOT nyet
Golden Bear Networks             PGP/GPG KeyID: 0x608D2A10
"Be who you are and say what you feel because those who mind don't matter
and those who matter don't mind." - Dr Seuss, "Oh the Places You'll Go"

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 663 bytes
Desc: OpenPGP digital signature
Url : /pipermail/attachments/20060924/c9e0c383/signature.pgp