Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,

[Andrey Jivsov <[e-mail]>]

On 06/28/2014 01:39 PM, Michael StJohns wrote:
> On 6/28/2014 4:31 PM, Andrey Jivsov wrote:
>> On 06/28/2014 12:59 PM, Michael StJohns wrote:
>>>
>>> >>>>  "IPR Issues":
>>>
>>> The specific set of IPR issues that concern me are the license and 
>>> copyright with respect to DJB's basic work.    Unless there is a 
>>> "perpetual, paid up, world-wide, irrevocable" license for anything 
>>> that he's done (or could do in this space) there are possible future 
>>> issues.  Something as simple as invoking the already existing 
>>> copyright on the curve data could be problematic.
>>>
>>> Note that I'm not saying this will happen, or that its even 
>>> contemplated,  but it's a potential problem that should be resolved 
>>> formally and legally.
>>>
>>> (It's possible there is such a document, but I went looking and 
>>> didn't find it.  Some of this is tagged "public domain" but that's 
>>> probably insufficient for most lawyers).
>>>
>>> If DJB et al is willing to transfer change control/copyright/patent 
>>> rights/moral rights to the IETF (via appropriate documentation), and 
>>> the IETF is willing to publish an actual standard then this 
>>> objection goes away. 
>>
>> BTW, focusing on F(p) (which is not really an ECC) also helps with 
>> the above concerns. p = 2^n-C is free due to the following expired 
>> patent : https://www.google.com/patents/US5159632 .
>>
>> IMO it would appear "safer" for hardware vendors to only 
>> implement/provide optimization primitives for F(p), for a couple of 
>> specific p's.
>
> If I generated parameters for F(p) and published them under normal 
> copyright, AFAIK you couldn't use them absent a copyright license 
> regardless of patent rights.   For the existing curves, those grants 
> of license exist in some form or another.   To avoid IPR issues, you 
> need a set of both technology (patent) rights and parameter 
> (copyright) rights.
>
> As I said, I just want the documentation to avoid future issues.

Staying within F(p), we know that 2^n - C is now free as an idea (ref. 
above). (There is a speculation is that P-521 was not made a part of 
Suite B due to that now expired patent )

It makes sense to have C smallest. C=189 for n=256 . ( As I wrote 
earlier, I don't see why it should be 2^255-19, but that p is selected 
using the same criteria )

It should be possible to find prior work by people who experimented with 
such primes. ( Starting from 
http://www.iacr.org/archive/ches2010/62250075/62250075.pdf, regarding 
2^256-189, and walking back in time... )