<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>On May 14, 2014, at 4:38 PM, Trevor Perrin <<a href="mailto:trevp@trevp.net">trevp@trevp.net</a>> wrote:</div><div><blockquote type="cite">I think Certicom's US filings were in 1995 so should expire in 2015,<br>which isn't that bad [1].<br><br>But IBM filed on HMQV, which I think doesn't expire till 2025 [2].<br></blockquote><div><br></div><div><div>I skimmed the HMQV patent, partly to see whether it reads on MQV-related PAKE augmentation.</div><div>I think that there’s a good chance that it doesn’t read on PAKE augmentation, because all the</div><div>top-level claims specify that:</div><div>...</div><div><span style="font-family: Arial, sans-serif; font-size: 13px; line-height: 21.33333396911621px; background-color: rgb(255, 255, 255);">there exists no secret shared between said verifier and said signer that serves as a basis</span></div><div><span style="font-family: Arial, sans-serif; font-size: 13px; line-height: 21.33333396911621px; background-color: rgb(255, 255, 255);">for any argument in any of said F1, F2, F3, and F4</span></div><div><span style="font-family: Arial, sans-serif; font-size: 13px; line-height: 21.33333396911621px; background-color: rgb(255, 255, 255);">...</span></div><div><span style="background-color: rgb(255, 255, 255);"><font face="Arial, sans-serif" size="2"><span style="line-height: 21.33333396911621px;">which is not true of a PAKE.</span></font></span></div></div><br><blockquote type="cite">So the original MQV is perhaps the closest to being feasible. Are the<br>enhancements in HMQV and successors that important? I guess I should<br>read that paper…</blockquote></div><br><div>In addition to defeating the known (minor but not completely insignificant) attacks on MQV itself,</div><div>the HMQV paper makes the key exchange kosher by, eg, not using the x-coordinate of points</div><div>without passing them through a hash function first. This is required for security proofs even in</div><div>edgy models like GapDH.</div><div><br></div><div>— Mike</div></body></html>