[saag] Re: New Version Notification for draft-rsalz-crypto-registries-00.txt

["D. J. Bernstein" <[e-mail]>]

Paul Wouters writes:
> The rough consensus is that there is no appetite for NTRUprime.

Um, what? There are multiple interoperable NTRU Prime implementations
for SSH, plus NTRU Prime implementations for various other protocols.
The SSHM WG adopted draft-josefsson-ntruprime-ssh earlier this month:

    https://mailarchive.ietf.org/arch/msg/ssh/yQrbHFDt085REimIkuWrnNqGgKU/

Consensus to adopt doesn't establish consensus regarding any particular
followup action, but it does override the earlier AD efforts to block
that document. Obviously there's interest in NTRU Prime.

At first glance, having IETF work on Kyber _and_ NTRU Prime, two small
lattice-based encryption systems, might seem redundant. However, a
closer look shows reasons to not be satisfied with Kyber, the most
obvious being the patent minefield surrounding Kyber:

    https://mailarchive.ietf.org/arch/msg/saag/b2EYReik4ziPXhSC7kw-ajQzc8w/

For example, the holder of patents CN107566121 etc. has written "Kyber
is covered by our patents". Those patents were filed before Kyber was
published. The patents will expire in 2036.

BCP 79 includes the following requirement:

    An IETF consensus has developed that no mandatory-to-implement
    security technology can be specified in an IETF specification unless
    it has no known IPR claims against it or a royalty-free license is
    available to implementers of the specification. It is possible to
    specify such a technology in violation of this principle if there is
    a very good reason to do so and if that reason is documented and
    agreed to through IETF consensus.

Documents in some IETF protocol contexts are violating this rule by
proposing Kyber as their only post-quantum encryption option. These
documents don't argue that the patent issues are outweighed by
technology issues that trigger a BCP 79 exception; the documents simply
ignore the patent issues.

I'd think that the ADs are responsible for enforcing this BCP 79
requirement. Instead the ADs seem to be _encouraging_ having Kyber as
the only post-quantum encryption option. This is a big problem. We've
already seen the same patent minefield causing years of delays in
post-quantum rollout, even without any patent holders having filed
lawsuits yet.

---D. J. Bernstein