Blockchain development is high now, but patent trolls threaten to stifle innovation.

The world of cryptography, and in protecting users and systems, has moved on so fast in the past year. Our weak systems, such as with Logjam and FREAK, have quickly been replaced, and where browsers just won't talk to systems which use weak encryption, such as for 1,024-bit Diffie-Hellman key exchange or with 512-bit RSA key exchange. At present, only Microsoft Internet Explorer allows for weak key exchange for the SSL connection, and where Chrome and Firefox just won't talk to systems which have weak methods. With talk around backdoors and key escrow, the browsers have pushed the industry along faster than anyone would imagine.

So just when we thought we had secured the Internet, and where it had moved on from Diffie-Hellman and 512-bit RSA key exchange methods to Elliptic Curve methods of exchanging session keys for HTTPs, we find our that someone thinks they have a patent around the methods of key creation using elliptic curve encryption. So this time it's not law enforcement looking for a back-door or weak encryption - it is possibly a patent troll.

With this a Texas-based company named CryptoPeak Solutions reckons that it has the patent on "auto-escrowable and auto-certifiable cryptosystems." The patent states [patent]:

The ARC Cryptosystem is based on a key generation mechanism that outputs a public/private key pair, and a certificate of proof that the key was generated according to the algorithm.

This certain defines the basics of ECDHE, but in no way does it actually go into the details of the methods used. They then say:

Each generated public/private key pair can be verified efficiently to be escrowed properly by anyone. The verification procedure does not use the private key. Hence, the general public has an efficient way of making sure that any given individual's private key is escrowed properly, and the trusted authorities will be able to access the private key if needed. 

which basically says that you can verify the key pair without actually using the private key. The patent hints towards the method of using RSA encryption to exchange the key, where the session key is sent back, encrypted with the public key of the server. The private key of the server is then used to unencrypt this key to reveal the session. ECDHE overcomes this by not requiring the private key of the server to be used.

With many current HTTPs systems we often use Elliptic Curve Diffie-Hellman Exchange (ECDHE) which uses the Elliptic Curve encryption method  [Link], which is wrapped within the Diffie-Hellman method, and which does not require the decryption of the key. There is thus a hint of the notion towards the patent, but the authors of the patent actually mention anything like ECDHE.

CryptoPeak Solutions have now targeted 66 companies for the usage of ECDHE on their Web site, including  AT&T, Netflix and Yahoo.

Conclusions

The world of patents is a strange one, and there are a whole lot of patent trolls who go after companies, hoping they can gain some financial gain in suing for patent breaches. Overall this often stifles innovation, and where the deep technical details of the breach can be glossed over. It can also often stop SMEs in their tracks, through the fear of being sued in the future.