Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-04.txt

["Björn Haase" <[e-mail]>]

Dear Riad,

>....if we lived in a universe without IPR concerns, my opinion would be
>that only Simplified SWU should be included. 
Yes. I agree with you here.


>The reason is, including
>any given algorithm is (at least tacitly) endorsing its use, and as
>far as I can see there is no *technical* justification for endorsing
>SWU over Simplified SWU.
>
>-=rsw

We'll have to struggle with the following situation: If we have too many options, we might face an incompatibility nightmare and complexity. And all complexity is bad for security because at least one of the options might have an exploitable implementation pitfall.

On the other hand dealing with licensing issues or even disputes at courts is extremely painful. Also a mere IPR conflict risk might motivate people use the second-best option security-wise or even scare away people from a helpful and more secure technology.

In my opinion dealing with this type of topic is something specific for an organization such as IETF or CFRG, in contrast to pure research work.

I have made quite some effort on analysis of possible IPR issues for hash2curve. Concluding my analysis today gives the following result:

- I believe Icart's mapping for curves with p mod 3 = 1 is covered by the morpho patent. For a product of my employer, I'd would not recommend using this approach without purchasing a license.
- I believe that simplified SWU in the form of the current draft is not covered by the claims in the patents that I have read so far. I would recommend using simplified SWU in products of my employer, however only after having arranged for an assessment by an experienced patent attorney and an assessment of *all* national applications or patents. Sometimes the claims differ significantly and there might be the risk of divisional applications with new claims in some countries, once the standard comes out.
- I believe that plain SWU is not covered by patents. For the plain SWU algorithm, I would recommend my employer to use the algorithm without the need of further analysis.


Summing up the only IPR issue in the current draft is Icart's mapping for P384. I have filed an official IPR notice for this aspect.

I believe that SWU and simplified SWU are not covered and I did not file an official IPR notice. Still when working on the draft, I'd like to suggest that the Icart and Icart/Coron patents regarding optimizations for plain SWU should carefully be kept in mind.

I further believe that apart of the two patents from Icart and the one from Icart/Coron no further patents might be around.

Yours Björn,

P.S.: Sorry for bothering you with these painful topics. Still I believe that getting a clear common picture on the IPR situation for hash2curve will be important pre-requisite for establishment of consensus regarding protocols for OPRF and PAKE.