I'm working on a P2P communications and chat framework, and am looking for a quantum-secure asymmetric key exchange algorithm which I can use to perform a key exchange of an AES-256 bit key. This is an open-source project which will be licensed under GPL-3.0, and I have considered using NTRU. However; I have discovered that NTRU is a patented cryptosystem, and is therefore not compliant with the licensing constraints that apply to my application. Are there any asymmetric key exchange systems other than NTRU which are not patent encumbered, and secure against quantum attacks?

UPDATE in response to NTRU answer
Turns out that the patent grant may not be in fact in compliance with the GPL. The patent grant document the answer refers to (PATENTS.md) states that

Businesses and enterprises that wish to incorporate NTRU cryptography into proprietary appliances or other commercial software products for re-distribution must have a commercial license

In contrast to the GPL, which permits commercial usage of a work if the commercial product is also licensed under the GPL. See the official FAQ on the matter of commercial use. This same FAQ page also clarifies, under a different section that the licensor cannot ban commercial/military use of a GPLd work as doing so is contradictory to the GPL.

UPDATE 2 -- Response from Security Innovation
The issue regarding GPL compliance has been sorted out. Below is an e-mail I have received clarifying the issue. I have decided to use NTRU under the GPL in my solution, and will be marking this answer as accepted.

Thanks for getting in touch. You're absolutely right, our patents.md file isn't correct: it specifies GPL but then contrasts GPLed use with commercial use of the patents, even though as you point out commercial use isn't precluded by GPL. So our patents.md file is not in fact consistent with GPL 2.0. This was an oversight on our part. The intent was to have language identical to what's in our licence.md file at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/LICENSE.md, specifically: "Parties who wish to distribute ntru-crypto, or components thereof, under licenses other than the GPL or the FOSS Exception must obtain a commercial license." This wording makes it clear, I hope, that in this context we use "commercial license" to mean "license for non-GPLed use". The intent is to be fully GPL compliant, including supporting commercial use under GPL. I'll work to get this language clarified on the site. Thanks for your eagle eyes, this is a good one to get sorted out. Hope this helps and let me know if you have any more questions. Cheers, William


locked by e-sushi Nov 17 '16 at 21:30

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

Read more about locked posts here.

  • 3
    $\begingroup$ If you like big keys, McEliece is an option. $\endgroup$ – CodesInChaos Dec 19 '15 at 18:05
  • $\begingroup$ On the note of McEliece, McBits (by Bernstein) may be your preferred option. The alternative may be, although I'm not 100% sure about patents, this Ring-LWE based one or one of its predecessor. $\endgroup$ – SEJPM Dec 19 '15 at 19:56
  • 4
    $\begingroup$ Warning: some of those Ring-LWE-based schemes have highly suboptimal choices of parameters, and/or use inadvisable error distributions. Another option is eprint.iacr.org/2015/1092 . $\endgroup$ – Chris Peikert Dec 19 '15 at 22:47
  • 3
    $\begingroup$ OP: When Chris Peikert gives you advice on lattice cryptosystems, you take it. $\endgroup$ – pg1989 Dec 20 '15 at 5:15
  • $\begingroup$ Also it should be mentioned that if you want something NTRU-like but with a proven reduction to a worst-case lattice problem you might want to look at eprint.iacr.org/2013/004. $\endgroup$ – pg1989 Dec 21 '15 at 6:47

I work for Security Innovation, which owns the NTRU patents. All NTRU-related patents are freely usable under GPL 2.0 and 3.0 -- in other words, they should fit in with your license requirement as given above. If you have specific license requirements beyond GPL please let me know and we'll accommodate them if we can.

There's an open-source C and Java implementation available from https://github.com/NTRUOpenSourceProject/ntru-crypto that you're welcome to use; it includes protection against CCA2 attacks and some features that reduce timing variability, so it's probably better to use that implementation than roll your own.

License statement about GPL is at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/LICENSE.md. The GPL licensing of NTRU is an irrevocable grant by Security Innovation, Inc. and cannot be withdrawn by Security Innovation, Inc, and/or any future owners of the Patented NTRU Algorithms.

List of covered patents (which is all the NTRU-related patents) is at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/PATENTS.md.

Hope this helps, and I'd be glad to help if you had any other questions about it.

  • $\begingroup$ Your patent grant states "Businesses and enterprises that wish to incorporate NTRU cryptography into proprietary appliances or other commercial software products for re-distribution must have a commercial license. Commercial licenses are available using flexible licensing terms on a one time per product fee or running royalty. For details please refer to COMMERCIAL LICENSE.doc included in this distribution." -- The GPL doesn't explicitly exclude commercial use, but states that anyone redistributing GPLd code must release their own work under the GPL. $\endgroup$ – IDWMaster Dec 20 '15 at 16:33
  • 1
    $\begingroup$ In other words; it doesn't appear that your patent grant is actually GPL-compliant. It's appears to be a kind of "crayon license", in which the terms of the GPL are slightly modified. (see opensource.stackexchange.com/questions/1445/…) $\endgroup$ – IDWMaster Dec 20 '15 at 16:34
  • 1
    $\begingroup$ You're right, the statement in PATENTS.md is not consistent with the GPL. That wasn't the intent, it is meant to be fully GPL-compliant. We're changing that now. $\endgroup$ – William Whyte Dec 21 '15 at 17:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.