Hacker News Reader

Comment by chasil | Hacker News Reader

One big reason that I know are patents.

Elliptic curve was a minefield of patents when Sun Microsystems carefully crafted the OpenSSL implementation to avoid any patent infringement. The resulting source code was vetted by their attorneys.

If any of those patents are still in force, then a naive implementation could infringe.

"Sun Microsystems has donated ECC code to OpenSSL and the Network Security Services (NSS) library..."

https://lwn.net/Articles/174784/

https://en.m.wikipedia.org/wiki/ECC_patents

A lot more attention was likely paid to this code than to heartbleed.

View on HN

Wow wasn't aware of that. Its funny to hear and agree with people proclaiming "privacy a right" and have the basic, fundamental technology behind make hairy the implementation of it.

I found out about that a few years ago.

If you run "openssl ecparam -list_curves" on a RHEL clone, you will only see p-256, p-384, and e-521 (and e-521 was only added in v7).

If you build libressl and run the same command, there are dozens (and Canada doesn't allow software patents, so it's legal there).

On OpenBSD 7.1, I see this result:

  $ openssl ecparam -list_curves | wc -l
  102

Note the 2 Oakley curves take up 8 lines. There are also 17 matches in this output for NIST curves.

Canada seems to allow software patents [1]. Amazon got a Canadian patent for their one-click stuff, as mentioned in that Wikipedia article.

Here's a Canadian patent on accelerated finite field operations on an elliptic curve [2]. Here's one on public key cryptography using elliptic curves [3].

[1] https://en.wikipedia.org/wiki/Software_patents_under_Canadia...

[2] https://brevets-patents.ic.gc.ca/opic-cipo/cpd/eng/patent/23...

[3] https://patents.google.com/patent/CA2129203A1/en

Probably more related to RHEL compiling openssl in FIPS mode.

No, Red Hat has confirmed that they are leery of patents.

https://bugzilla.redhat.com/show_bug.cgi?id=319901#c2

Tomas Mraz 2007-10-05 10:23:00 UTC: "They are intentionally removed due to possible patent issues."

Bill McGonigle 2013-04-11 06:26:53 UTC: "I've read that Sun's ECC code (that went to OpenSSL) was developed to specifically avoid Certicom patents, but I've only seen that asserted, not proven."

Jan-Frode Myklebust 2013-10-07 09:18:49 UTC: "Is this now solved in the RHEL6.5 beta... only the nistp256 and nistp384 curves are supported."

OpenSSL is the reference implementation of TLS, so when teams propose new TLS features (like the heartbeat extension), they tend to add them to OpenSSL. At the time of Heartbleed, OpenSSL got nothing resembling the attention it does today, so it wasn't insane to think that some random proof-of-concept code might find its way in.

If you examine this six year ECC support request, you will see that Sun's code saw legal attention.

https://bugzilla.redhat.com/show_bug.cgi?id=319901#c2

Reply on news.ycombinator.com