Re: [Cfrg] Questions regarding new draft-irtf-cfrg-voprf-00 from A. Davidson, N. Sullivan and Chr. Wood // Will we need to consider IPR issues here?

["Björn Haase" <[e-mail]>]

Hi to all,
 
during the last days I have spent a bit of time reviewed the IPR situation for hashing to curves such as P-256. 

The true issue seems rather to be Icart's invention from FR2946818A1 (held by morpho) and not FR2946819B1 (Icart and Coron). Both of these refer to some particular use of SWU for hashing to curves.

After re-reading the patentents, my personal assessment is now that simplified SWU as specified in the hash2curve RFC could be freely used for both, OPRF and PAKE applications also on curves such as P-256. 
However, I'd appreciate if somebody else could have a closer look.

In the more critical patent FR2946818A1 one of the three polynoms from SWU ( P_3(x) ) has been required to be -1 explicitly.
In fact for simplifying SWU, P_3(x) could be chosen such that it is any non-square. It seems that this latter thing
is what the current hash2curve RFC draft is doing when choosing the value Z from section 6.5.2 (i.e. avoiding the non-square value -1 that is claimed in the patent).
I thus conclude that this morpho patent does not apply to the algorithm of the RFC. Also in the text body of the patent I did not find any statement regarding the fact that instead of -1 any non-square could be used, such that any divisional application based on the contents of the descriptive text should not be able to cover the general case of a "non-square" P_3 as used in the RFC.

In fact in the other patent text by Icart and Coron, claim 4 explicitly refers also to the case that P_3(x) from SWU is an arbitrary non-square, i.e. not having the restriction above. However claim 4 of this patent refers to the context of claim 1 only which (in my opinion) does not correspond to what the hash2curve RFC is doing. Thus I believe that also this second patent will not be any issue for what is done in draft-irtf-cfrg-hash-to-curve.

Yours,

Björn.