5 ms·

> NSA has a patent on ECC ... Wow, I was not aware that it was even possible for government agencies to hold patents. Is there any reasonable justification fo

by quesera 11y ago

> NSA has a patent on ECC ... Wow, I was not aware that it was even possible for government agencies to hold patents. Is there any reasonable justification for that?

stock_toaster 11y ago
Maybe to prevent some private company from patenting it? It depends on what one does with a patent. I would think making it free for anyone use, if that were indeed the case, would be appropriate though.
- nickpsecurity 11y ago
  Who knows NSA's purpose. Certicom's was money from licensing: so much that their company (mainly patents) sold for over a hundred million dollars to Blackberry. I have details in comment above.
kragen 11y ago
Neither the NSA nor anybody else has a patent on ECC. (And no, there is no reasonable justification for government agencies to hold patents, except to make them free to the public.) There are some patents on particular ECC techniques, as explained in http://cr.yp.to/ecdh/patents.html http://cr.yp.to/ecdh/patents.html, but they do not cover the currently most popular ECC systems, and in any case they are mostly expired.
- quesera 11y ago
  That's what I would have thought, but then I DuckDuckGo'ed it (awkward!)... http://foreignpolicy.com/2014/07/30/the-nsas-patents-in-one-searchable-database/ http://foreignpolicy.com/2014/07/30/the-nsas-patents-in-one-... Also, from https://www.nsa.gov/research/tnw/tnw193/articles/pdfs/TNW193_article4.pdf https://www.nsa.gov/research/tnw/tnw193/articles/pdfs/TNW193... (PDF): > You may be surprised to hear that NSA seeks patents. However, many of the technologies developed by NSA not only satisfy mission requirements, but also have great potential for commercial use. Following extensive review, NSA may seek patent protection for such technologies as a way to protect and build on the US government’s (USG) investment in research and development.
  - kragen 11y ago
    I don't see anything in there that contradicts what I said.
- nickpsecurity 11y ago
  See my above reply concerning 130 patents on ECC.
  - tptacek 11y ago
    That's not what you said. You said NSA had patents, demanded licenses for their commercial use, and then more or less implied that the condition they imposed on the use of those curves was to backdoor or subvert software that use them. Obviously, no.
    - nickpsecurity 11y ago
      I've updated it for clarification. The NSA did have patents, though. After those expired, they licensed Certicom's and their web site even mentions that this only applies to products conforming to their expectations. As in, they control those to quite a degree. The alternative was paying Certicom a licensing fee. It's still on their web site.
      - quesera 11y ago
        See https://www.nsa.gov/business/programs/quick_facts.shtml https://www.nsa.gov/business/programs/quick_facts.shtml for the ECC patent license agreement. It appears to be free, but your use needs to pass some fairly specific restrictions. Not sure if the PLA is available at any cost if your use does not pass.
        nickpsecurity 11y ago
        @ quesara Yeah that's the one. It has to be FIPS 140-2 compliant or approved by NSA. Outside Type 1 devices or FIPS Level 3-4, both of those seem to suck in practice for security. One way or another, it doesn't get unless they approve it. Edit to add: That covers the small selection of patents NSA licensed for use in their implementations (esp FIPS 140-2 products). There's around a hundred more of unknown effect. I'd love to see a detailed breakdown of those and risk posed in various ECC use cases.
        11y ago
deleted 11y ago
[deleted]

by quesera 11y ago

> NSA has a patent on ECC ... Wow, I was not aware that it was even possible for government agencies to hold patents. Is there any reasonable justification for that?

stock_toaster 11y ago

Maybe to prevent some private company from patenting it? It depends on what one does with a patent. I would think making it free for anyone use, if that were indeed the case, would be appropriate though.

nickpsecurity 11y ago
Who knows NSA's purpose. Certicom's was money from licensing: so much that their company (mainly patents) sold for over a hundred million dollars to Blackberry. I have details in comment above.

kragen 11y ago

Neither the NSA nor anybody else has a patent on ECC. (And no, there is no reasonable justification for government agencies to hold patents, except to make them free to the public.) There are some patents on particular ECC techniques, as explained in http://cr.yp.to/ecdh/patents.html http://cr.yp.to/ecdh/patents.html, but they do not cover the currently most popular ECC systems, and in any case they are mostly expired.

quesera 11y ago
That's what I would have thought, but then I DuckDuckGo'ed it (awkward!)... http://foreignpolicy.com/2014/07/30/the-nsas-patents-in-one-searchable-database/ http://foreignpolicy.com/2014/07/30/the-nsas-patents-in-one-... Also, from https://www.nsa.gov/research/tnw/tnw193/articles/pdfs/TNW193_article4.pdf https://www.nsa.gov/research/tnw/tnw193/articles/pdfs/TNW193... (PDF): > You may be surprised to hear that NSA seeks patents. However, many of the technologies developed by NSA not only satisfy mission requirements, but also have great potential for commercial use. Following extensive review, NSA may seek patent protection for such technologies as a way to protect and build on the US government’s (USG) investment in research and development.
- kragen 11y ago
  I don't see anything in there that contradicts what I said.
nickpsecurity 11y ago
See my above reply concerning 130 patents on ECC.
- tptacek 11y ago
  That's not what you said. You said NSA had patents, demanded licenses for their commercial use, and then more or less implied that the condition they imposed on the use of those curves was to backdoor or subvert software that use them. Obviously, no.
  - nickpsecurity 11y ago
    I've updated it for clarification. The NSA did have patents, though. After those expired, they licensed Certicom's and their web site even mentions that this only applies to products conforming to their expectations. As in, they control those to quite a degree. The alternative was paying Certicom a licensing fee. It's still on their web site.
    - quesera 11y ago
      See https://www.nsa.gov/business/programs/quick_facts.shtml https://www.nsa.gov/business/programs/quick_facts.shtml for the ECC patent license agreement. It appears to be free, but your use needs to pass some fairly specific restrictions. Not sure if the PLA is available at any cost if your use does not pass.
      - nickpsecurity 11y ago
        @ quesara Yeah that's the one. It has to be FIPS 140-2 compliant or approved by NSA. Outside Type 1 devices or FIPS Level 3-4, both of those seem to suck in practice for security. One way or another, it doesn't get unless they approve it. Edit to add: That covers the small selection of patents NSA licensed for use in their implementations (esp FIPS 140-2 products). There's around a hundred more of unknown effect. I'd love to see a detailed breakdown of those and risk posed in various ECC use cases.
      - 11y ago

deleted 11y ago

[deleted]