ECC patents?

[Alexander Klimov]

On Tue, 13 Sep 2005, Paul Hoffman wrote:
> At 9:32 AM -0700 9/12/05, James A. Donald wrote:
> >It has been a long time, and no one has paid out
> >money on an ECC patent yet.
>
> That's pretty bold statement that folks at Certicom might disagree
> with, even before
> <http://www1.ietf.org/proceedings_new/04nov/slides/saag-2/sld1.htm>.

http://www1.ietf.org/proceedings_new/04nov/slides/saag-2/sld9.htm:

  What is Really Covered
  o  The use of elliptic curves defined over GF(p) where p is a prime
     number greater than 2^255 when the product satisfies the Field of
     Use conditions
  o  Both compressed and uncompressed point implementations
  o  Use of elliptic curve MQV and ECDSA under the above conditions

This hints that indeed only some particular curves are patented.
Grepping -list_curves of the new openssl (0.9.8) which has a list of
curves from SECG, WTLS, NIST, and X9.62 gives not that much:

  secp256k1 : SECG curve over a 256 bit prime field
  secp384r1 : NIST/SECG curve over a 384 bit prime field
  secp521r1 : NIST/SECG curve over a 521 bit prime field
  prime256v1: X9.62/SECG curve over a 256 bit prime field

Alternatively, this coverage can be interpreted that NSA is not
interested in curves which provide less security than 128-bit AES.

Any idea, which alternative is true?

-- 
Regards,
ASK

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com