Subject: Re: [TLS] [tls13-spec] Require support for compressed point format (#80)

From: Watson Ladd <[email-masked]>
Date: Wed, 10 Sep 2014 09:07:32 -0700

On Sep 10, 2014 8:50 AM, "Henrik Grubbström (Grubba)" <
[email-masked]> wrote:
>
> AFAIK the compressed format has issues with patents (eg US patent 6141420
and US patent 6252960) and is not supported by some ECC-libraries.
>
> Note though that according to djb those patents are likely to be invalid (
http://cr.yp.to/ecdh/patents.html).

They expired a month ago iirc.
>
> Note also that it is the uncompressed format that is the required format
in RFC 4492.

Because of the patents. There are security issues I have exploited in
software that result from use of an uncompressed format.
>
> —
> Reply to this email directly or view it on GitHub.

---

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Wed, 10 Sep 2014 18:48:05 +0200

> They expired a month ago iirc.

The first one [1] expired a month ago. The second one [2] expires in 4 years,
but describes a different method of point compression that the one used in TLS
(and PKIX). TLS uses the full X coordinate plus one bit of Y, while the goal of
the second patent is to get rid of that bit of Y by reusing a redundant bit of
the encoding of X.

[1] https://www.google.com/patents/US6141420
[2] https://www.google.com/patents/US6252960

> software that result from use of an uncompressed format.

Is that just invalid curve attacks due to the implementation failing to check
that the point is on the expected curve, or are there other kind of attacks that
rely on uncompressed format?

Manuel.