7
votes
$\begingroup$

I'm working on a P2P communications and chat framework, and am looking for a quantum-secure asymmetric key exchange algorithm which I can use to perform a key exchange of an AES-256 bit key. This is an open-source project which will be licensed under GPL-3.0, and I have considered using NTRU. However; I have discovered that NTRU is a patented cryptosystem, and is therefore not compliant with the licensing constraints that apply to my application. Are there any asymmetric key exchange systems other than NTRU which are not patent encumbered, and secure against quantum attacks?

UPDATE in response to NTRU answer
Turns out that the patent grant may not be in fact in compliance with the GPL. The patent grant document the answer refers to (PATENTS.md) states that

Businesses and enterprises that wish to incorporate NTRU cryptography into proprietary appliances or other commercial software products for re-distribution must have a commercial license

In contrast to the GPL, which permits commercial usage of a work if the commercial product is also licensed under the GPL. See the official FAQ on the matter of commercial use. This same FAQ page also clarifies, under a different section that the licensor cannot ban commercial/military use of a GPLd work as doing so is contradictory to the GPL.

UPDATE 2 -- Response from Security Innovation
The issue regarding GPL compliance has been sorted out. Below is an e-mail I have received clarifying the issue. I have decided to use NTRU under the GPL in my solution, and will be marking this answer as accepted.

Thanks for getting in touch. You're absolutely right, our patents.md file isn't correct: it specifies GPL but then contrasts GPLed use with commercial use of the patents, even though as you point out commercial use isn't precluded by GPL. So our patents.md file is not in fact consistent with GPL 2.0. This was an oversight on our part. The intent was to have language identical to what's in our licence.md file at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/LICENSE.md, specifically: "Parties who wish to distribute ntru-crypto, or components thereof, under licenses other than the GPL or the FOSS Exception must obtain a commercial license." This wording makes it clear, I hope, that in this context we use "commercial license" to mean "license for non-GPLed use". The intent is to be fully GPL compliant, including supporting commercial use under GPL. I'll work to get this language clarified on the site. Thanks for your eagle eyes, this is a good one to get sorted out. Hope this helps and let me know if you have any more questions. Cheers, William

$\endgroup$
6
  • 3
    $\begingroup$ If you like big keys, McEliece is an option. $\endgroup$
    – CodesInChaos
    Dec 19, 2015 at 18:05
  • $\begingroup$ On the note of McEliece, McBits (by Bernstein) may be your preferred option. The alternative may be, although I'm not 100% sure about patents, this Ring-LWE based one or one of its predecessor. $\endgroup$
    – SEJPM
    Dec 19, 2015 at 19:56
  • 4
    $\begingroup$ Warning: some of those Ring-LWE-based schemes have highly suboptimal choices of parameters, and/or use inadvisable error distributions. Another option is eprint.iacr.org/2015/1092 . $\endgroup$
    – Chris Peikert
    Dec 19, 2015 at 22:47
  • 3
    $\begingroup$ OP: When Chris Peikert gives you advice on lattice cryptosystems, you take it. $\endgroup$
    – pg1989
    Dec 20, 2015 at 5:15
  • $\begingroup$ Also it should be mentioned that if you want something NTRU-like but with a proven reduction to a worst-case lattice problem you might want to look at eprint.iacr.org/2013/004. $\endgroup$
    – pg1989
    Dec 21, 2015 at 6:47

1 Answer 1

Reset to default
7
votes
$\begingroup$

I work for Security Innovation, which owns the NTRU patents. All NTRU-related patents are freely usable under GPL 2.0 and 3.0 -- in other words, they should fit in with your license requirement as given above. If you have specific license requirements beyond GPL please let me know and we'll accommodate them if we can.

There's an open-source C and Java implementation available from https://github.com/NTRUOpenSourceProject/ntru-crypto that you're welcome to use; it includes protection against CCA2 attacks and some features that reduce timing variability, so it's probably better to use that implementation than roll your own.

License statement about GPL is at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/LICENSE.md. The GPL licensing of NTRU is an irrevocable grant by Security Innovation, Inc. and cannot be withdrawn by Security Innovation, Inc, and/or any future owners of the Patented NTRU Algorithms.

List of covered patents (which is all the NTRU-related patents) is at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/PATENTS.md.

Hope this helps, and I'd be glad to help if you had any other questions about it.

$\endgroup$
3
  • $\begingroup$ Your patent grant states "Businesses and enterprises that wish to incorporate NTRU cryptography into proprietary appliances or other commercial software products for re-distribution must have a commercial license. Commercial licenses are available using flexible licensing terms on a one time per product fee or running royalty. For details please refer to COMMERCIAL LICENSE.doc included in this distribution." -- The GPL doesn't explicitly exclude commercial use, but states that anyone redistributing GPLd code must release their own work under the GPL. $\endgroup$
    – bbosak
    Dec 20, 2015 at 16:33
  • 1
    $\begingroup$ In other words; it doesn't appear that your patent grant is actually GPL-compliant. It's appears to be a kind of "crayon license", in which the terms of the GPL are slightly modified. (see opensource.stackexchange.com/questions/1445/…) $\endgroup$
    – bbosak
    Dec 20, 2015 at 16:34
  • 1
    $\begingroup$ You're right, the statement in PATENTS.md is not consistent with the GPL. That wasn't the intent, it is meant to be fully GPL-compliant. We're changing that now. $\endgroup$
    – William Whyte
    Dec 21, 2015 at 17:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.