Re: [Cfrg] Fwd: [TLS] Curve25519 in TLS and Additional Curves in TLS

[Robert Ransom <[e-mail]>]

On 1/28/14, Andrey Jivsov <[e-mail]> wrote:
> On 01/23/2014 06:58 PM, Robert Ransom wrote:
>> On 1/23/14, Andrey Jivsov <[e-mail]> wrote:
>>
>>> Wouldn't http://tools.ietf.org/html/draft-jivsov-ecc-compact be another
>>> method?
>>
>>> ( BTW, the proposal in the draft is in public domain since it was
>>> published on December 10, 2012. )
>>
>> Are you claiming that the point format that I suggested is patented?
>
> I was making a statement about my contribution, in case this issue comes
> up.
>
> The IP for the use of 1 bit to compress a point is a common knowledge,
> but I've heard that some of them are expiring.

If you are referring to the patent addressed in
<http://cr.yp.to/patents/us/6141420.html>, claim 29 of the same patent
covers point decompression with your proposal.


> However, I am concerned about the cofactor issue. These curves have the
> cofactor greater than 1. Unlike "unsafe" NIST curves, this needs to be
> handled. The draft suggest methods that, as I understand them, may run
> into IP issues. Besides, there may be protocols that want to do classic
> DH. One solution to these issues is to enumerate the points in the small
> subgroup, explicitly in the document, or by providing the method to
> identify them.

U.S. patent 6,226,383 (Jablon) claims 31 and 32 cover the use of your
suggestion in ECDH.


Dr. Bernstein's paper which specifies Curve25519 for use in ECDH
addresses its groups' cofactors by (a) generating Diffie-Hellman
keypairs such that the secret exponent is divisible by the cofactor
(as is common in multiplicative-group Diffie-Hellman, where the
cofactor is at least 2), and (b) requiring that the shared-secret
group element be used only as input to a hash function or hash-based
KDF (as is required for all Diffie-Hellman systems).

Are you aware of any specific patent claims which cover these
techniques, or are you merely trying to spread patent FUD?


Robert Ransom