Re: [Cfrg] Elliptic Curve patents

["D. J. Bernstein" <[e-mail]>]

Michael Scott writes:
> But I would read this as suggesting that Siemens holds a patent on
> twist secure curves (like GoldiLocks).

https://cr.yp.to/talks/2001.10.29/slides.ps gives an example of a curve
for ECC selected with 16*prime order. It summarizes the performance of
the Montgomery ladder and says "Twist has order 8*prime, so don't need
to check whether compressed input K_b is on curve."

https://groups.google.com/forum/message/raw?msg=sci.crypt/mu_paShEU3w/m491pYxHbtAJ
has a similar comment.

As far as I know, the first attempt to patent twist security was
http://www.freepatentsonline.com/DE10161138A1.html, but this was filed
in Germany after my slides were posted, so the slides automatically
count as prior art even if the "inventors" claim that they were first.

In the US, back then, there was a 1-year period after publication when
other people were free to file a patent on the same idea, as long as
they claimed that they had invented it earlier. For some reason this
1-year period was called a "grace period" rather than a "fraud period".
Anyway, Germany never had any similar rule, and as far as I know these
"inventors" didn't start filing for ECC patents in the US until many
years later.

---Dan