Re: [Cfrg] Recent SM2 and SM3 drafts update

[Sean Shen 沈烁 <[e-mail]>]

hi, Uri

> >>Are there (free :) reference implementations available?
> >Yes, there are free implementations, please check the infor web I
> >included in the email:
> >http://218.241.108.63/wiki/en/index.php/Main_Page
> >There is a "software implementation" link on the left.
> 
> Nice!
> 
> Unfortunately, quite a few things - including directory name in at least
> one case - are in Chinese (literally :). Since unfortunately I don't
> speak/read Chinese, it adds unnecessary difficulties. Suggestion: edit it
> so they are entirely in English, preferably using ASCII.

Thanks for the suggestions. I checked the codes, one of them has a Chinese word in direction name, 3 of them have Chinese comments in the codes, only one code is in pure English. 
Here is what I will do: since I am not the author of the codes, probably not proper for me to change the codes. I will have the Chinese translated and provide the pure English versions for download beside the original ones, also provide a note on the download page and stating the situation. 
This will be done before Monday afternoon (Beijing time). 

Here are the details:
________________________________________________
1. 
c language open source codes:SM2,SM3,SM4
http://218.241.108.63/wiki/en/index.php/File:Sm2_sm3_sm4_c_language_open_source_code.zip

There is a Chinese word in Dictionary. I will replace it by English.

2. 
Java language:ECC
http://218.241.108.63/wiki/en/index.php/File:Java_ecc_code.zip

There are Chinese comments in the codes. I will translate it in English.

3. 
openssl language:SM2
http://218.241.108.63/wiki/en/index.php/File:SM2-Openssl_language.zip

No langusage problems

4. 
Java language:SM3
http://218.241.108.63/wiki/en/index.php/File:Sm3-Java.zip

There are a lot Chinese comments in the codes. I will translate it in English.

5. 
Java language:SM4
http://218.241.108.63/wiki/en/index.php/File:Sm4-Java.zip

There are a few Chinese comments in the codes. I will translate it in English.
____________________________________________________________________

 
> Also, I'd like to second the question that Joachim asked earlier: what are
> the Copyright and Intellectual Property statements for this code, and for
> these algorithms? Who owns them, and who does the owner allow usage of
> those algorithms (and of that code)? On what conditions (if any are
> stated)?

Good questions.
As for the algorithms, here is what I am aware of: 
There is patent (or patents) with the algorithms. But when the algorithms were adopted by TCG (Trusted Computing Group) in TPM 2.0 standards, the owners announced these patents free in TCG. I contacted the owners and they are discussing to give statement here following IETF's rules. I will keep updating it for all, on both my web and ietf mailing list.
As for the codes, they were collected on the internet, some from programmers' community or from course projects, by people who are interested in this area or students who did course project. These are just for simple testing of the algorithms. If I need codes for my serious purpose (commercial or non-commercial), I would prefer commercial development work or our own development, it's not a lot work after all.   
Authors of these codes didn't left information regarding copyright or license, I am contacting the authors of the codes via limited contact information in codes, if I am lucky to get in touched with them, they might give more information.    
Also CCed and thanks Joachim for his attention. I try to put similar answers in this single reply so that I won't miss any if the thread goes long. 

> Also, I'm interested in the SM2 suite, especially its Authenticated Key
> Exchange part. Us there (a) a complete description in English, and (b)
> source code available for it? There was a paper at CANS 2011 "Comments on
> SM2 Key Exchange" that pointed out a weakness, and suggested a fix for it.
> Can you tell whether that suggestion has been incorporated in the current
> SM2 key exchange standard?

Thanks for this information. To answer that I will finish reading the paper and give clear feedback. I will give feedbacks soon following Watson's thread.   
Thanks!

Sean

> Again, to repeat myself and echo Joachim: in order to do anything with
> these algorithms (even to look at them) we need to know their
> licensing/IPR and copyright status.
> 
> Thanks!