[Pqc] Question about NIST Kyber Patent License

[James Edington Administrator <[e-mail]>]

A quick question for the Post-Quantum Use in Protocols Working Group:

I see that you gave a presentation
<https://www.youtube.com/video/B5x0AvfTrUU?t=2830> last year at the 116th
IETF meeting, warning people about the ambiguous state of the patent
license NIST claims to have secured for Kyber. As the maintainers of pypqc
on PyPI <https://pypi.org/project/pypqc/>, we're also interested in
resolving the Kyber patent licensing situation.

Have you made any progress on nailing down those terms, beyond what was
shown in that presentation?

I'm asking before we open a deeper discussion with NIST, so that we can
avoid wasting our time --- or NIST's legal team's time --- retrying any
angles of attack that other people might have already exhausted.

(To be clear, in this thread, I'm *only* referring to patents US9094189B2
and US9246675, which NIST already claims to have secured licenses for. I'm
*not* requesting, in this thread, to open the proverbial Pandora's Box of
speculation about the legitimacy or applicability of those patents, or of
other lattice mathematics patents NIST hasn't acknowledged the legitimacy
of. I know that there's a lot of genuine ambiguity here going both ways
that needs to be discussed at some point, ideally with a patent lawyer; but
in this thread I'm *only* asking about the terms of the license NIST claims
to have secured for the 2 most notorious patents considered to encumber
Kyber.)

Thanks for your consideration,

--
James E. A.
[e-mail]
---------- Forwarded message ---------
From: Moody, Dustin (Fed) <[e-mail]>
Date: Tue, Jan 16, 2024 at 10:14 AM
Subject: [External] Re: Kyber patent licensing
To: James Edington Administrator <[e-mail]>


James,

Thank you for the feedback. I'm not a lawyer, so I can't speak for any
legal aspects and will forward your comments to our NIST legal team.  I can
also help set up a meeting with them if you'd like, where they can try to
address your concerns.  I don't think they plan to release the full
agreements, but several other parties have met with them and come away
satisfied after the meeting.

As I said, I'm not a lawyer, and can't promise anything, but from my
perspective you don't need to worry about those two patents if you
implement what is in the NIST standard.

Dustin
------------------------------
*From:* James Edington Administrator <[e-mail]>
*Sent:* Tuesday, January 16, 2024 10:52 AM
*To:* pqc-comments <[e-mail]>
*Subject:* Kyber patent licensing


I'm trying to publish an implementation of Kyber, but I'm worried about
liability exposure from patents US9094189B2 and US9246675.

While researching, I found that you had reportedly licensed these patents
for use with Kyber. However, the full agreement is not publicly available
to my knowledge, so I can't tell whether it would actually be legal for me
to publish an implementation.

I see you've published a summary[1] of these licenses, but I and many
others[2][3][4][5] find it *deeply concerning* that the actual patent
license isn't anywhere to be found.

Right now, any implementers are only taking your word that we even have
permission to use the algorithm, and, legally speaking, that is a
disturbing situation to be in.

Please release the full license agreement you negotiated for these patents,
because we cannot safely implement Kyber without knowing the full terms.

[1] "NIST PQC License Summary and Excerpts", 29 Nov 2022,
https://csrc.nist.gov/csrc/media/Projects/post-quantum-cryptography/documents/selected-algos-2022/nist-pqc-license-summary-and-excerpts.pdf

[2] Scott Fluhrer, Principal Engineer, Cisco Systems Security and Trust
Organization, *pqc-forum*, 15 Jul 2022,
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/G0DoD7lkGPk/m/d7Zw0qhGBwAJ

[3] Daniel Apon, MITRE cryptography lead, *pqc-forum*, 15 Jul 2022,
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/G0DoD7lkGPk/m/G_evJqQNKQAJ

[4] Greg Maxwell, *pqc-forum*, 11 Aug 2022,
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/G0DoD7lkGPk/m/of2mVEnlEAAJ

[5] IETF Post-Quantum Use in Protocols Working Group, "Patents and PQC", *IETF
116 Meeting*, 31 Mar 2023,
https://datatracker.ietf.org/meeting/116/proceedings#pquip

Thanks for your consideration,
--
James E. A.
[phone]
[e-mail]