Re: [TLS] IPR Disclosure from Certicom

[Bill Frantz <frantz at pwpconsult.com>]

simon at josefsson.org (Simon Josefsson) on Monday, May 11, 2009 wrote:

>   Certicom will, upon request, provide a nonexclusive, royalty free paten
>   t license, to
>   manufacturers to permit end users (including both client and server sid
>   es), to use the patents in
>   schedule A when implementing any of these protocols, including those re
>   quiring third party
>   certificates provided the certificate is obtained from a licensed Certi
>   ficate Authority (CA). This
>   license does not cover the issuing of certificates by a Certification A
>   uthority (CA).

I read this as saying you should not use any elliptic curve cryptography
that depends on Certicom's patents if you are using self-signed
certificates or acting as your own CA (unless you have a license from
Certicom). The easiest way to avoid Certicom's patents is to avoid elliptic
curve cryptography.

Cheers - Bill

---------------------------------------------------------------------------
Bill Frantz        |"We used to quip that "password" is the most common
408-356-8506       | password. Now it's 'password1.' Who said users haven't
www.periwinkle.com | learned anything about security?" -- Bruce Schneier