Security Company Tries To Hide Flaws By Threatening Infringement Suit

An anonymous reader writes: An RFID-based access control system called IClass is used across the globe to provide physical access controls. This system relies on cryptography to secure communications between a tag and a reader. Since 2010, several academic papers have been released which expose the cryptographic insecurity of the IClass system. Based on these papers, Martin Holst Swende implemented the IClass ciphers in a software library, which he released under the GNU General Public License.

The library is useful to experiment with and determine the security level of an access control system (that you own or have explicit consent to study). However, last Friday, Swende received an email from INSIDE Secure, which notified him of (potential) intellectual property infringement, warning him off distributing the library under threat of "infringement action." Interestingly, it seems this is not the first time HID Global has exerted legal pressure to suppress information.

Comments

Patent infringement

[phantomfive]

He is not being threatened for copyright infringement, he's being warned about patent infringement. Here is the link to the patent in question (there's also a European patent). Furthermore, it seems the lawyers have determined that he has not committed infringement himself, but users of his library may use it to infringe. Therefore, the letter does not even threaten any legal action at all. It's just a friendly request.....or as friendly as lawyers ever get.

Below I will paste the specific patent's independent claims. I don't think this can actually cover generic software written for the PC, because of the 'secret memory' and the fact that they have patented the device implemented in hardware, not a software implementation of the algorithm (and how many computers actually have a pseudo-random shift register?)

1. Method of producing an authentication code (CA), comprising cycles for reading binary words (Mn) out of a secret memory (21) comprising a plurality of binary words, wherein, at each cycle, the address for reading a word out of the secret memory (21) is generated from an address generating binary word (GA) forming the result of a combination operation (Fc, ) of words (M1 to Mn) read out of the memory during previous cycles, characterised in that it comprises a transform operation of the address generating word (GA) consisting in logically combining at least one bit (g'0, g'1, g'2) of the address generating word (GA) with at least one bit (r1, r4, r6) of a pseudo-random shift register (26).

8. Logic machine (20, 20-1, 30) clocked by a clock signal (H), comprising a secret memory (21) in which a plurality of binary words read out at clock rate are stored, wherein the output of the memory (21) is applied to a first input (A) of a logic circuit (22) whose output (C) is fed back to the second input (B), the logic circuit (22) performing a combination (Fc, "+") of its two inputs (A, B) and producing an address generating binary word (GA) supplied to the address input (ADR) of the memory, characterised in that it comprises a pseudo-random shift register (26) and logic means (25-1, 27) for combining at least one bit (r1, r4, r6) of the shift register (26) with at least one bit (g'0, g'1, g'2) of the address generating word (GA).