Slashdot Mirror
Will Expiration of RSA's Patent Unencumber SSL/PGP?
petej asks: "Big companies with valuable patents usually don't put all their eggs in one basket. It's common practice to build a "patent fence" around the main patent, so that when the main one expires, the others preserve the company's hegemony on their technology. When the main RSA patent expires next year, will there be any other RSA patents that might cover and encumber PGP or OpenSSL? Will we really have a freely available SSL toolkit in OpenSSL, or will we still be forced to buy an RSA license because of some other patent?"
Sure. ECC is pretty much patent-free. There are a few very specific algorithms that are patented (most of them pertain to ECC's efficient hardware implimentation, however) The core of ECC is completely free though. And recent ECC cracking challenges have demonstrated that it is a WHOLE lot more secure than RSA (it took a longer period of processor time to crack a 97-bit ECC key, which is considered to be the equivalent of the 512-bit RSA key, than it did to crack the 512 RSA key). ECC simply does not have any known subexponential-time attacks, while RSA already does. Yes, they maybe found in the future, but they already exist in RSA, so at this time there is no question that ECC is more secure than RSA. I believe that it is time to throw RSA out the window because of the very fast recent attacks on the system. It is true, we might want to wait a bit before jumping on the ECC wagon and declaring it the most secure cryptosystem ever, but regardless of that RSA should not be trusted to protect any sensetive information (especially if it is needed to keep that information secure for a long period of time). Choosing longer RSA keys is simply not a solution to the problem, since in a few years down the road these keys may be easily cracked as well.
Patents on crypto algorithms don't bother me that much, but when they start patenting the kinds of ideas that I think up when I'm driving I get pretty pissed.
Perhaps I'm nit picking... But please be careful. Our laws regarding encryption exports are not *AT ALL* the same as the US Laws. If something is produced in the us, and is under US export control, then we recognize that and place the same controls on it. This is the price we pay for getting easy access to it. (US export restrictions don't apply to Canada) If it's developed anywhere else, in Canada or otherwise, we can do whatever we want. (nearly) If it's in the public domain, there are absolutely no permits or anything required. If it's a business venture, there are export permits necessary.. but this is no different than those necessary for any other export.
The Schnorr patent covers some of the knowledge-proof protocols that are used when using public-key crypto systems for contractual things
(I think... it's been a while since I've read the literature =) so it's still an issue when cryptography is used to enforce standards of behavior and such. It might also have an impact on things that Free Software projects are planning in the future.
Is RSA still important? If so, what niche does it fill?
RSA is still very important because it is the de-facto standard for asymmetric encryption. Other PK algorithms (DH) are much more cumbersome to use in a disconnected environment, and AFAIK no other PK algorithm supports multiple recipients and signatures as easily as RSA.
There is a lot of infrastructure already using RSA. There is little point in throwing it all away when the algorithm is going to be free by the end of next year.
RSADSI is a big company who depends heavily on the RSA algorithm for their revenue. You can bet that they have scores of lawyers who will try to intimidate anyone who tries to use the RSA algorithm after expiry.
They would probably not win any case that made it to court, but that is enough to scare many smaller companies into purchasing a license. Most of the larger companies already have licenses.
PGP (2.x at least) still uses the IDEA algorithm which is patented by Ascom Systec of Switzerland, so it is not totally free.
GnuPG does not use any patented algorithms and is a much better product anyway. There also exist plug-in RSA implementations which allow it be backwards compatible with PGP 2.x.
Right, and that's what GPG does, at least for the PGP equivalence. The 1.0 version came out a month or so ago.
Unfortunately, such a program is indeed a "workalike", but it is not compatible with existing systems. SSL with RSA/RC4 and PGP with RSA/IDEA have large installed bases, and unencumbered software cannot be compatible (until all the patents expire).
-Doug
The above statements on RC4 are entirely true. It is worth noting, however, that an algorithm called ARCFOUR is an internet draft (possibly RFC by now) before the IETF. As the name implies, it is a description of an RC4 compatible algorithm. I believe it is proposed by Rodney Thayer of the IPSEC community.
In any case, RC4 is less useful than RC2 in contexts other than TLS since it is a stream cipher and therefore rather harder to use securely.
My company has done extensive research into the issue of the RSA patent and has talked to many other companies in the field. We are certain that the expiry of the patent in September will leave RSA as used in modern protocols totally unencumbered.
While, DSA and DH-EG are very good algorithms, each has its own quirks and you still need two sets of keys. Whil ehaving separate signing and encryption keys is very good security practice, it can be inconvenient for some sets of applications. In addition, RSA is by far the most widely implemented algorithm and so it is very important for interoperability between implementations and across standards. The Thawte example above is quite common in the PKI industry.
It is worth noting that an industry rumour has it that RSADSI make about 50% of their money from litigation, 25-30% from the RSA conference (now really a trade show), 10% from patent licensing and the rest from licensing of toolkits. Of course, this is entirely hearsay.
In fairness to RSA, they do at least appear to plough a lot of this money back into research through RSA Labs who do a lot of important work.
Agreed, but that very fact probably makes the patent invalid. In order to be patentable, an idea has to be innovative, not something that would be obvious to anyone with a working knowledge of the area in question. Of course, the patent offices don't tend to have the required working knowledge, and so issue patents that they really shouldn't. However, the fact the the patent is issued doesn't make it valid, and it's unlikely to stand up in court. That doesn't help when J. Random Corporation has millions to pay lawyers and you don't, though...
"The invisible and the non-existent look very much alike." -- Delos B. McKown
The RSA cipher and any uses of it will open whn the patent expires. This means that US citizens will finally be able to use the RSA implementation in SSLeay/OpenSSL, or roll their own.
/. readers won't want to buy Crypto-C. It's enormously expensive. RSA can now focus on selling to huge companies and not twiddling around, suing the little guy. Frankly, I think the patent expiring will be the best thing for the company since Bidzos joined the board.
The RC ciphers, RC2, RC4 and RC5, are copyrighted. The names are trademarked. This means that you can not use RSA's code, or the names RC[245], without RSA's permissions. But, you can use AAILRC5EFTN, An Algorithm Incredibally Like RC5 Except For The Name. Basically, RC5 (or 2 or 4), but named different.
BSAFE, now known as Crypto-C, is a product of RSA's, just like any other software product. You will still need to buy it if you want to use it.
RSA's strategy is to move upwards in the food chain, while continuing to promote Crypto-C as the best of breed. They are making PKI toolkits now. PKI toolkits give developers the ability to handle authentication, do work with certificates, and do other, Public Key stuff that relates to Infrastructures. OpenCA would mimic one portion of RSA's Keon offering.
Crypto-C will now be sold a little differently. Instead of "you have to pay us anyway, why not just buy the toolkit", it's now "this is the absolute best crypto toolkit and you should buy it". And they have a point. Crypto-C is highly optimized for all sorts of platforms, has been continually reviewed for security by RSA Labs, has been ported to a huge number of platforms,is easy to work with, and generally an all-around righteous toolkit.
Most
Citizens Against Plate Tectonics
If GPG uses IDEA, then it is only in a plugin. From the homepage:
Supports ElGamal (signature and encryption), DSA, 3DES, Blowfish, Twofish, CAST5, MD5, SHA-1, RIPE-MD-160 and TIGER.
Unfortunately, such a program is indeed a "workalike", but it is not compatible with existing systems. SSL with RSA/RC4 and PGP with RSA/IDEA have large installed bases, and unencumbered software cannot be compatible (until all the patents expire).
RC4, interestingly enough, is essentially a free algorithm; unlike some of the other RC algorithms it is not patented. It was protected as a trade secret for many years, but eventually the source code (maybe reverse engineered from Netscape or something) escaped to Usenet. So you can use RC4, you just can't call it that. Which is why ssh calls it arcfour.
Really, the important patent was the patent on Diffie-Hellman key exchange, since this was the first public key algorithm. Since it has already expired, it's already possible to build totally free SSL/PGP workalikes without any patented code. You just need to add a free symmetric key cryptosystem like Blowfish or triple DES.
IANAL, but I had a meeting with one a few weeks ago about patents. I learned some interesting things. Most interesting (and distressing) to me was when I learned about what "disclosure" is actually about.
Basically, when you a) offer for sale or b) publish your work, you're "disclosing" it publicly (even if you sell it to a client who's under NDA, you are "offering it for sale", which means it's been disclosed).
From the time of disclosure, you have one year to "patent, or get off the pot". However, if you don't start your filing process either before you disclose, or real darned soon thereafter, someone else can! That is to say, if you show no interest in patenting your work during the post-disclosure window, someone else who sees value in it can patent it.
Of course, to a Free Software / Free Hardware / Free Ideas zealot like myself, this is a pretty appalling state of affairs. What it means to me, in a nutshell, is that I have to go through the cumbersome and expensive process of patenting my "novel inventions" (and, in this day and age, even my "totally fscking obvious inventions to anyone with two brain cells to rub together"), in order to keep them from, basically, getting pirated.
That means that I cannot simply disclose and rest secure in the knowledge that the freedom of my ideas is protected, and that they will remain free from the moment of disclosure thereafter.
That sucks.
(ObDisclaimer: IANAL, and I may have horribly misunderstood this, but I did ask a great many questions of this poor guy, and attempt to clarify that I was actually hearing what I thought I was).
If he comes up with something that's really a breakthrough, it would be a very good idea of him to patent it, license it to everyone for free but with the condition that anyone who uses it cannot assert crypto patents against other parties.
Netscape does this with their SSL API patent (granted, their patent is IMHO questionable) but they grant an automatic royalty free license to everyone to implement or use the SSL/TLS protocols, on the condition that they assert none of their own patents against other parties for implementing the SSL/TLS specs.
EjB
Let's keep this straight:
I think copyright protection was recently extended to be consistent with EU law.
The patent protection extension was based on drugs that have to be approved by the FDA. Since drugs often take so long to be approved, the drug companies wanted to know that they would have a certain length of time during which they could use the patent. As I recall, the patent protection was to be 20 years or 15 years after FDA approval in the case of drugs.
So no, software patents have not been extended on us.
First, don't forget (if you ever knew) that Netscape (now AOL) holds a patent on SSL itself. In the past, Netscape's policy was to freely license the patent to anyone who agreed not to dispute its validity, but I don't know if that's AOL's current policy, or if they'll change that in the future. There are also 14 patents which reference the SSL patent.
With respect to RSA (the company)'s control over RSA (the algorithm) it will, indeed, end on 9/20/2000 - but that means one thing to open source developers, and something else to developers who are using BSAFE or one of RSA's other toolkits.
For several years now, RSA has been very, very reluctant to issue a bare patent license for the RSA algorithm. What they will cheerfully do is give you a license to use the patent, so long as you also use their (licensed) object libraries which implement the code. This leads to continued control over the market after 9/20/2000 in two ways: by forcing licensees to recompile using other crypto libraries, since the libraries themselves are still covered by copyright even after the patent expires; and by limiting the number of competitive libraries and programmers with experience writing/using those libraries, since it hasn't been legal (in the US) to create them.
Consequently, developers who have been using RSA-licensed proprietary object code thus far will likely continue to use it (and to pay royalties to RSA) even after the patent expires. Developers who have been using open source libraries like SSLeay and OpenSSL will be well-positioned to take advantage of the expiry. The two lead programmers on the SSLeay project, Tim Hudson and Eric Young, have been RSA employees for about a year now, so updates to the package won't come from them. (See http://www.cryptsoft.com/~eeay/ for more on that.)
I was going to write that RSADSI could Open Source their products, and that they would probably do quite well out of it at the moment, because it would let them pick up on the favourable buzz surrounding Open Source companies at the moment. (Open Source, E-Commerce & Security.. Gee, there is a market!)
BUT then I realised that they probably cannot, for legal reasons. Quite apart from the patents, they still cannot export (all) their sources despite the recent Crypto law reforms, can they?
Can someone expand on this, please.
RIPEMD-160 is a hash function not covered by patents. Its fairly trivial to convert it to an encryption system and/or public/private key style crypto..altho it might reference some anal patents if you did that. im not familiar with any others and have mainly used RIPEMD160.
The RSA patent is referenced by 174 newer patents. That means that (at least) 174 other people have similar "inventions", some real, some questionable, which directly use the RSA algorithm. Here it is.
The problem is that its hard to tell what uses of RSA are actually covered by these newer patents. It doesn't matter whether the use is "obvious" to us, it's just impossible to tell what uses are covered without going through everything. Translation: RSA will be available soon, but it's use for almost anything commercial/useful will still be independently patentable.
Personally I have always been rather surprised that the field of crypography is so littered with patents everywhere. You would think that near genius crypographers like R and S would be the first to realize that the flows and uses of information can only truly to controlled by mathematics - and that attempts to do so by law, straight in the face of the very nature of information, are not only futile but ultimetly very harmful.
It is thankful that there are also people like Schneier in the field.
-
Even if that were true, you'd have to prove it in court to break the patent. What evidence do you have?
Also: I understand there's some precident for the time the government has used a secret invention not counting against the time the public-and-patented version is protected. (Could be wrong - I'm not a patent attorney.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I work at a company that does telecom products. Our lawyers did a lot of research on the RSA patent. Some of you may already know this, but some of you might not:
RSA
---
RSA is protected by a US patent. Everyone knows this. However, the patent only applies to the US, which does NOT include Canada (some people think the RSA patent also applies to Canada since our crypto laws are identical). So if you are not an american company, you can sell your product WITH RSA all over the world except in the US.
In the US I would suggest using DSA instead of RSA. Works very well. The only problem is that you will have trouble finding certificate authorities that support DSA (Verisign, GTE Cybertrust, etc... only support RSA certs). You might want to check these:
http://www.equifax.com : they are supposed to have DSA support.
http://www.arcanvs.com : they already support DSA certs.
http://www.thawte.com : they support DSA certs BUT they are signed by an intermediate DSA issuing cert that in turn is signed by an RSA cert. So it doens't really work if you have to avoid using RSA. BUT, if enough people e-mail the president of Thawte and say they would like DSA certs they might provide support earlier... By the way, the president (Mark Shuttleworth) answers e-mails in less then a day and he knows more then just sales figures...
Also, Thawte has the greatest test facility among all CAs out there! Just go in the "test" section on their web page. You can test everything, RSA certs, DSA certs, PKCS7 chains, etc.
RC4
---
RC4 is not patented, but it is copyrighted. Not the algorithm, but its implementation. However, as we all know the algorithm was leaked some years ago and today it is considered public knowledge since you can find it in any book. So you can use the algorithm FREE anywhere in the world if you make your own implementation without basing your work on an implementation that was done by RSADSI. You also have to rename the algorithm. You can't use the name "RC4". But you can use "AV4" for instance.
If you are not using RSA then you might want to forget about RC4 because there are not SSL Ciphersuites that combine DSA (the RSA alternative) and RC4.
MD2
---
We also did some research on that (our lawyers actually) and you can actually use the name MD2 (unlike RC4) and use the alg. free if you can write an implementation independantly of any implementation done by RSADSI or the implementation found in the RFC.
I don't know about MD5 because we used a library that gave us the right to use MD5...