6
$\begingroup$

As I understand it from web conference hearsay, the Kyber and Saber entries to the NIST post quantum cryptography competition have been subject to a patent claim from the CNRS. The creators of the schemes wanted their cryptosystems to be public domain and opposed the legal claims based on mathematical grounds, which was apparently ignored by the lawyers.

Does anyone know what the exact extent of the CNRS patent claims are? Do they apply only to the KEMs or do they extend to any of the signature schemes as well? It would be great to have a good rundown of the legal status of the concerned systems.

$\endgroup$
9
  • 1
    $\begingroup$ I don't have an authoritative answer to your question (and I would be interested in hearing it), but a couple of things you misheard: for one, I don't believe that there's currently any pending lawsuits; what CNRS has is a patent that may (or may not) cover Kyber and Saber (and so CNRS wouldn't have copyright claims, but patent claims). I have looked through their patent; while IANAL, it would appear to cover only KEMs and not signatures (hence answering some part of your question). $\endgroup$
    – poncho
    Feb 2, 2022 at 19:24
  • 1
    $\begingroup$ Also, neither Kyber nor Saber are specifically French; the Kyber team has only one French individual (Damien Stehle) out of ten, and the Saber team appears to be based in Belgium (KU Leuven). CNRS ("National Center for Scientific Research"), on the other hand, is a French company (think tank? reseach group? I'm not quite sure) $\endgroup$
    – poncho
    Feb 2, 2022 at 19:52
  • $\begingroup$ OK, made a quick edit to the question to clarify that for now it's a patent claim, not a lawsuit, and also just referred to the two affected KEMs specifically by name. $\endgroup$
    – saolof
    Feb 2, 2022 at 21:02
  • 1
    $\begingroup$ This doesn’t directly answer your question (and I doubt anybody here can), but this may be of interest: eprint.iacr.org/2021/1364 $\endgroup$ Feb 2, 2022 at 21:41
  • 1
    $\begingroup$ @ChrisPeikert: unfortunately, the question of whether the patent applies is ultimately not a technical one, but a legal one - it is unlikely to be settled until a judge makes a ruling (and that certainly won't happen anytime soon...) $\endgroup$
    – poncho
    Feb 2, 2022 at 22:13

1 Answer 1

3
$\begingroup$

Some days ago, the patent was left. The patent is held by 2 entities : the CNRS (French national research center) and the Université of Limoges. They both agreed to turn the patent free of use. It have never been clear whether this patent really applied to this PQ algorithms. Some notable cryptographers such as Bernstein wrote extensively that this patent fully applied. In a way, this license agreement proves he was right. To me, the agreement was done to get rid of any potential issue, even if the threat was not real. Anyway, the case is now closed, thanks to this new license agreement.
https://www.cnrs.fr/index.php/en/license-agreement-between-nist-cnrs-and-university-limoges-international-impact-french-research

I cannot tell the exact technical and legal basis of the patent claim.

$\endgroup$
3
  • 1
    $\begingroup$ Thanks, good to know. One thing: I'm not sure that the sentence "the patent was left" captures the intent of the agreement. The patent is still present, but the users of the PQC algorithms that (probably?) have been derived from it do not have to have a licensing agreement in place. $\endgroup$
    – Maarten Bodewes
    Jul 9, 2022 at 17:57
  • $\begingroup$ Good to know about this update, especially now that NIST standardization made it very relevant for near-term implementations. $\endgroup$
    – saolof
    Jul 10, 2022 at 14:16
  • $\begingroup$ Yes "left" was not the best chosen word. In a way the agreement is to clarify that the patent holder won't claim any rights concerning the NIST PQ algos with this patent at the heart of the dispute. This kind of neutralizes this patent against NIST PQ algo. That makes the NIST PQ algorithms out of reach of this patent, leaving the road clear for a public and free to use standard. As stated in the article : "Implementers and end users of cryptographic standards derived from the selected PQC algorithms will not need a separate license under the CNRS patent family." $\endgroup$
    – antonio-fr
    Jul 10, 2022 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.