Post Structure:

  1. Sources Cited
  2. Question & Details
  3. Before You Answer
  4. Useful Info From Comments

Sources Cited:

  1. https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-encryption/ (see first comment on the blog)

  2. https://competitions.cr.yp.to/round1/ocbv1.pdf

  3. https://csrc.nist.gov/CSRC/media/Projects/Block-Cipher-Techniques/documents/BCM/proposed-modes/gcm/gcm-nist-ipr.pdf (shared by @fgrieu in the first comment)

  4. https://eprint.iacr.org/2004/193.pdf


Are the AE modes -- specifically AES-GCM -- safe ( i.e. won't cause legal issues ) for commercial use presently (October 2018)?

The aforementioned sources point to the fact that various AE schemes are patented by VDG and IBM.

Specifically, the 'Intellectual Property' section of the second source states:

"Gligor and Donescu (VDG) and Jutla (IBM) are inventors (owners) on US patents 6,963,976, 6,973,187, 7,093,126, and 8,107,620, all which concern AE but which may or may not apply to OCB."

Before You Answer:

  1. I understand these sources are 6-12 years old.

  2. The obvious argument that the details of the patents are not specified, and probably do permit the usage, given the widespread use of these AE schemes, is understood.

  3. Despite point (2) above, the question is posed not out of laziness, but to check if the current ( official? ) status is already known, and verify the point (2).

  4. My search term "Authenticated Encryption Usage Patents" does not return any existing answers to this question.

  5. The second source says "If any of this information changes, the submitters will promptly (and within at most one month) announce these changes on the crypto-competitions mailing list."; this is probably where the current status should be.

Useful Info From Comments:

  1. Based on the first comment citing the third source above, the GCM authors do not claim any rights on the mode, nor are aware of any. Additionally, the fourth source states the same.

"The authors are unaware of any intellectual property rights that pertain to the Galois/Counter Mode of operation (GCM) [1], nor do they claim any such rights. The avoidance of such en­cumbrances was a specific design goal of the mode. It is based on methods that appeared in the literature over two decades ago: counter mode and universal hashing."

"The Galois/Counter Mode (GCM) of operation for block ciphers was designed to meet the need for an authenticated encryption mode that can efficiently achieve speeds of 10 gigabits per second and higher in hardware, can perform well in software, and is free of intellectual property restrictions"

  • 3
    $\begingroup$ Not an answer, but a reference of interest in the question: D. McGrew and J. Viega's The Galois/Counter Mode of Operation (GCM) Intellectual Property Statement, and the references it cites. This document is accessory to their contribution of GCM to the NIST. The NIST acknowledges they "co-invented GCM and submitted it to NIST". $\endgroup$
    – fgrieu
    Oct 18 '18 at 7:55
  • 1
    $\begingroup$ I'm voting to close this question as off-topic because it is about legal aspects of potential patents. Simpler stated: this is about international patent laws, not about how a cryptographic algorithm/protocol/scheme/whatever works. $\hspace{0.5in}$ Additionally, I’ld like to note that asking for legal advice at any website is hardly a good alternative to consulting a lawyer. Since you mention you’re planning commercial use, getting professional legal advice from lawyers is a logic step. Patents are a minefield, so please contact a local patent law office for legal consultation and advice. $\endgroup$
    – e-sushi
    Oct 21 '18 at 1:02
  • $\begingroup$ @e-sushi your explanation is ill-fitting because the question doesn't ask for legal advice; only for the present status of the patents held on these modes. Every cryptographer I have read mentions how OCB was patented; and so did the cited crypto resources here; the question is in the same vain. Your explanation assumes either that there couldn't be a user with knowledge about the enquired status, or that users wouldn't gain anything by understanding that these modes are patented -- a fact which seems obscure enough to not have a single mention on any of the forums. Don't kill knowledge flow. $\endgroup$ Oct 21 '18 at 1:35
  • $\begingroup$ If it helps clarify: 1) The AES-ECB mode is not safe to use because it is not secure and can be broken easily. 2) The OCB mode is safe to use for open-source and non-military projects; it is also safe to use in terms of the cryptographic security. 3) The primitive-based hashing is not safe to use because it is not secure, although it might be safe to use anyway because there are no patents to stop you from using it. $\endgroup$ Oct 21 '18 at 2:12
  • $\begingroup$ I'll keep it short by saying that asking about the patent status of something is asking for legal advice. And my comment was anything but ill fitted, since you confirmed it yourself in your question: Are the AE modes -- specifically AES-GCM -- safe ( i.e. won't cause legal issues ) for commercial use presently (October 2018)? — I'll repeat that for your convenience "won't cause legal issues", aka legal advice, aka off-topic. We are not lawyers, which is why I advised you to lconzact one to clarify the patent status as part of your commercial endeavors. $\endgroup$
    – e-sushi
    Oct 22 '18 at 12:43