# Why is the market for cryptographic primitives non-commercialized?

There are not many successful companies in cryptographic primitives market. Certicom holds many patents attached to the ECC. RSA Security probably made some profits from the patent. Are there more examples?

Why do people, scientists not try to commercialize their achievements, despite the fact that they could do so, especially under patent protection? I know it's harder to sell a product when most solutions are free. I know that a patent can makes it difficult to adopt technology in this market.

Nevertheless, it is still not clear to me why such powerful and universally useful technologies are being developed and made available in a charitable way.

• "despite the fact that they could do so" history teaches us that they could not. – Maeher Apr 19 at 18:38

Offering a crypto technology for free is the easiest, and certainly one of the reason that's done. Alternatives are:

1. Keeping it secret.
2. Patenting it and selling licenses.

An example of 1 is the Clifford Christopher Cocks cryptosystem, which is precisely RSA with $$e=N$$, and remained unpublished for 24 years. The technology is not widely used until it is rediscovered or leaks, because it's not known. Attempting to use the crypto technology without publishing it has multiple technical drawbacks (see comments), and I fail to exhibit a case where that allowed the inventors to make much money.

In 2, if the patent is valid and useful but can be circumvented, people will do that and not use the patented technique. An example is the Schnorr signature patent, which DSA circumvented.

Reasons why 2 is uncommon include:

• Patenting takes effort, time, and money (especially after the first year when the inventor/owner must translate and file the patent in each territory they want protection in).
• More often than not, patents turn out to be invalid due to prior art, or actually cover a narrow improvement of prior art that is not essential, allowing circumvention of the patent, negating much of it's commercial value. Wounded crypto patents however can remain useful as a deterrent against clones or interoperable devices, and as ammunition in a larger patent war.
• In USA, but not (most at least) other parts of the world, there is one year to patent one's invention after disclosing it, e.g. in a crypto conference. This has limited the geographic scope of some crypto patents to USA. An example is the RSA patent.
• It's often hard to identify products that use a crypto technique, because crypto specs often are secret. This complicates commercial exploitation of crypto patents.
• In many countries, abstract math techniques can't be patented. To oversimplify, hardware implementing them can, not software. The line is thin, and further complicates commercial exploitation of crypto patents.
• Crypto technology often is implemented/used in software, and combined with the above that fragments the market to a point where it becomes economically difficult to make money out of patent licensing.

I think Cryptography Research / Rambus was successful at licensing anti-DPA techniques because they end up used in hardware and by very few economic actors, like Smart Card manufacturers.

• Keeping it secret is a possibility if you don't need interoperability (which sometimes you don't). However, with cryptography, the question will then arise "why then should I trust it?" – poncho Apr 20 at 12:20
• Interoperability is an underrated point and certainly a big part of the answer. Secrecy, intellectual property, and licensing make interop difficult or expensive. The cost of the initial buy-in is a big disincentive. The common-carrier components need to be open standards. Then, let vendors compete and make money on a pretty UI, systems relying on crypto, etc. – cbare Apr 20 at 22:31
• deterrents against interoperable devices is one way to make sure your product never takes off, but for the product that does still sell, your company gets a larger share of the money – user253751 Apr 21 at 9:01

Are there more examples?

About the only other example I can think of is Cryptography Research Inc (now owned by Rambus); however what they sell is methods of implementing primitives (in ways that are resistant to side channel attacks); however those operate just like the standard primitives, so that might not count.

Why do people, scientists not try to commercialize their achievements, despite the fact that they could do so, especially under patent protection.

They could certainly try; however they are quite unlikely to succeed. A large part of the crypto community is quite allergic to anything patented (unless that patented has been released for all uses); unless what they have is considerably better than the alternatives, it'll not be used at all (and so the patent fees will be for nothing).

I know that a patent can makes it difficult to adopt technology in this market.

Think: close to near impossible. Consider the case of OCB; it might be a bit better than the competing competitors as a way to do authenticated encryption (e.g. GCM); however GCM was patent free and OCB was not, no one uses OCB.

Yes, if someone did have (say) a practical FHE method (say, with homomorphic multiplication only 1,000 times slower than an unencrypted multiplication), you could make a mint (because there is nothing else able to come close to that); however this side of such a radical improvement, people will look for unencumbered alternatives (and be able to find them)

And, while we're on the subject: I believe Certicom's patenting (and aggressive threats of lawsuits) on some implementation methods for ECC (they certainly did not own the concept of ECC) slowed down the adoption of ECC by several years; certainly, the company I was with refused to touch it until the patent scenario was resolved. Yes, Certicom did make some money; however I don't believe this was a net plus for the crypto community...

• NTRU, Schnorr signature are patented, and we had overcome with EdDSA on Schnorr signature. – kelalaka Apr 19 at 21:18
• @Tom: "I categorically disagree that private innovation will be a minus for the crypto community"; I never said it was - what I said was that threating patent lawsuits (for the most part, unwarranted; however until it goes to a judge, who can say for sure) stiffles innovation (in this case, the use of ECC). In any case, I'm not speculating; I was there; I know why my company didn't want to touch ECC... – poncho Apr 20 at 3:09
• A desirable property of crypto primitives is that a lot of people have looked at it and not found any flaws. There is a community that does this for patent-free ciphers, to some extent for fun, to make a name for themselves or as part of their work at university. For patent-encumbered ciphers, the same people would ask themselves why they should work for free for someone else's profit, so this vetting isn't done. A patent holder could invest significant amounts of money upfront here, but would have to recoup these costs somehow. – Simon Richter Apr 20 at 14:41
• @SimonRichter: actually, the same three reasons you gave for looking at IP-free ciphers would also apply to patented algorithms. – poncho Apr 20 at 14:51
• @Nobody: "crypto is currently mostly made by academics"; depends on what you mean. Academics are in the majority in designing crypto systems (although there are participants from industry); as for implementing crypto, well, that's mostly industry (I count organizations such as OpenSSL and BouncyCastle as industry, because they sell support). In any case, I'm pretty sure that private companies generally don't consider the possible feelings of academics when making business decisions... – poncho Apr 21 at 21:41

It is worth mentioning that people do try to patent some cryptographic primitives, with certain upsides/downsides for adoption. For example, in the ongoing NIST PQC standardization, the Round5 protocol did not offer a royalty-free license for its use. While this was not the only reason it failed to advance to the third round, it is explicitly mentioned as a contributing reason (see page 17).

Perhaps a bigger potential patent WRT the NIST PQC competition is one summarized by Bernstein here. I can't attempt to summarize this --- I am not a patent lawyer, and have seen many (also not patent lawyers --- although perhaps one person posted some message saying they had a patent background) people dispute Bernstein's perspective. Regardless of the impact on the competition, the existence of a patent that may be applicable has sparked much debate/worry (I've even heard it may have killed Google's experiment with the NewHope cryptosystem in Chrome, but don't know anything concrete).