[Cfrg] patent situation regarding hash2curve as used in some PAKE nominations

[Björn Haase <[e-mail]>]

In the last week I have spent some time regarding the patent situation
for hash-2-curve which is an important requirement for some
of the PAKE nominations.

We were aware of some patent pitfalls that drove us to include a patent
circumvention approach based on the TBPEKE construction in our paper
"for the case of need".

After some discussion with patent people and some further research I now
come to the conclusion that with the recent draft of the hash2curve RFC,
we should be keeping safely away from the patents. Methods such as the
circumvention approach from Appendix A of the AuCPace paper are most
surely not necessary and should not be used.

The important aspect is that it seems that in all relevant countries
divisional applications seem to be ruled out for patents that once have
been granted. Historically this was not the case everywhere, but
legislation seem to have been harmonized. This means that for the
existing patents that we only need to consider what is actually claimed
and not what might be interpreted successfully into the descriptive
text. My main concern so far was that the patent family of the joint
work of Icart and Coron might generate trouble in the context of
divisional applications because the descriptive text explicitly
references also to the use of any non-square special value as part of
the mapping algorithm for simplying SWU.

I now come to the conclusion, that as long we keep away from the exact
value of the non-square "-1" for simplified SWU constructions, we should
not be facing patent problems.

@Riad: Maybe you could also double check that what you are doing in the
RFC for your version of the simplified SWU is not covered by claim 1 of
US 8,718,276 B2.

Yours,

Björn.