Re: [Cfrg] Comb algorithm IPR status

[Mike Hamburg <[e-mail]>]

On 03/05/2015 06:54 PM, Benjamin Black wrote:
> There are only two possibilities:
>
> 1) The combs in the reference implementations of Goldilocks448 and 
> NUMS 512 are not the same, in which case you have an existence proof 
> of there being multiple techniques to achieve high performance and 
> there never was a legitimate IPR concern.
> 2) The combs in the reference implementations of Goldilocks448 and 
> NUMS 512 are the same, in which case you have the IPR concern express 
> previously.
>
> Which is it?

Hi Benjamin,

The combs are different (SABS vs mLSBS), but it does not follow that 
there was no IPR
concern.  The '907 patent could have covered SABS in addition to mLSBS, 
or some
other patent could have read on either or both, or I could have misread 
your code and it
wasn't doing anything patented, etc.

I said in my second public email on the subject -- the one in which I 
apologized for rashly
drafting the first an hour and a half earlier --

"""
I expect (though I am not sure) that any patents that may turn up will 
not affect which
curves should be chosen, either because they can be worked around or 
because they
apply equally to all curves.  However, it is likely that patents will 
influence protocols and
internal algorithms, and perhaps also things coordinate choice or point 
encoding.
Conceivably the result could be relevant to the Montgomery vs Edwards 
discussion,
particularly if there is no IPR-free version of the comb algorithm.
"""

Again, the '907 issue was not about curve choice, at least not for me.

Cheers,
-- Mike