Re: [Cfrg] patent situation regarding hash2curve as used in some PAKE nominations

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

Excellent, thanks! 

I'm glad to hear that P-384 is still "safe" for hash2curve.

On 10/17/19, 8:59 AM, "Björn Haase" <[e-mail]> wrote:

    Dear Uri,
    
    The possible patent problem persists for curves with p = 1 mod 4.  I did believe P-384 to belong to this class.
    
    I see now that among the NIST curves the case p mod 4 == 1 seems only to apply to P-224. I was confused by the fact that the draft 04 did suggest Icart's mapping for  p = 2 mod 3 for the case of P-384.
    
    
    The approach for simplified SWU from Appendix D.2 from WD19 could only be taken for p = 3 mod 4. 
    The general simplified SWU which works also for p = 1 mod 4 (without the approach D.2 from WD19) would be different but still quite close to the patented method.
    Icart's special method for p = 2 mod 3 is also patented.
    
    
    So the increased patent-collision risk seems only to apply to P-224 which should not be recommended anyway as having less than 128 bit security level.
    
    Yours,
    
    Björn.
    
    
    
    
    
    Mit freundlichen Grüßen I Best Regards 
    
    Dr. Björn Haase 
    
    Senior Expert Electronics | TGREH Electronics Hardware
    Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 Gerlingen | Germany
    Phone: [phone] | Fax: [phone]
    [e-mail] |  www.conducta.endress.com 
    
    
    
    
    
    Endress+Hauser Conducta GmbH+Co.KG
    Amtsgericht Stuttgart HRA 201908
    Sitz der Gesellschaft: Gerlingen
    Persönlich haftende Gesellschafterin:
    Endress+Hauser Conducta Verwaltungsgesellschaft mbH
    Sitz der Gesellschaft: Gerlingen
    Amtsgericht Stuttgart HRA 201929
    Geschäftsführer: Dr. Manfred Jagiella
    
     
    Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu informieren, wenn wir personenbezogene Daten von Ihnen erheben.
    Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis (https://www.endress.com/de/cookies-endress+hauser-website) nach.
    
     
    
    
    
    Disclaimer: 
    
    The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive this in error, please contact the sender and delete the material from any computer. This e-mail does not constitute a contract offer, a contract amendment, or an acceptance of a contract offer unless explicitly and conspicuously designated or stated as such.
     
    
    
    -----Ursprüngliche Nachricht-----
    Von: Blumenthal, Uri - 0553 - MITLL <[e-mail]> 
    Gesendet: Donnerstag, 17. Oktober 2019 14:20
    An: Björn Haase <[e-mail]>; [e-mail]
    Betreff: Re: [Cfrg] patent situation regarding hash2curve as used in some PAKE nominations
    
    >    -	Don’t specify cipher-suites using P-384 for PAKE algorithms requiring mapping
    >  algorithms but recommend only Edwards/Montgomery curves or Short-Weierstrass
    >  curves with p = 3 mod 4, such as BrainPool, P-256 and P-521.
    
    I have a problem with exclusion of P-384. Are there patent issues with mapping for P-384, and do you see a way to avoid them, but still use P-384?
    
    Thanks!