NIST statement on IP

[Moody, Dustin (Fed)]

As was described in the original Call for Proposals, and discussed on the PQC Forum, NIST has been reviewing intellectual property claims against the PQC finalists.  While submitters were required to disclose applicable patents and declare their intent regarding licensing, a challenge in this process has been addressing IP claims by third parties, particularly against lattice-based candidates.  NIST continues to engage IP holders to discuss applicability and intentions regarding licensing.  We recognize the impact that even questions over IPR and licensing terms can have on the adoption of cryptographic algorithms. 

For the sake of clarity, though, we should acknowledge NIST’s constraints up front: The question of whether these patent claims apply to the PQC finalists cannot be decisively determined by NIST, since it is a legal question.    Because of this, we do not expect definitive answers on the applicability of patents during the timeline of this selection process.  Furthermore, NIST does not have significant resources to license patents on behalf of implementers and users of cryptographic technologies.  

We would still like to hear from the community how intellectual property considerations will impact their adoption of any of the finalists, including questions over applicability and the effect of royalty-bearing licenses.  

Dustin Moody

NIST

[Watson Ladd]

The easiest way to sidestep the issue would be to standardize the original 1996 NTRU scheme, or a variant that only changes the ring.

What we saw with ECC was that the NSA deal with Certicom gave credence to Certicom's claims and lead to nearly a decade of Red Hat obstruction, harming security of the entire Internet. We don't have 20 years for ECC: today's ciphertexts are tomorrows quantum computer input.

Sincerely,

Watson Ladd

--
Astra mortemque praestare gradatim