Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:10:57
David Jablon (dpj@world.std.com)
Mon, 10 Aug 1998 22:00:29 -0400
Dr. Schnorr wrote:
>> [...] The principal goal of the
>> DSS design is to steal the core of that invention. The recipe for
>> such robbery is well known:
At 01:10 PM 8/10/98 -0400, Perry E. Metzger wrote:
>Might I suggest that you leave the vitriol to the courts? CodherPlunks
>is not for this sort of discussion.
Aside from the emotional twist, the topic seems relevant to me.
Schnorr's factual statements seem reasonable, even if the
interpretation is one-sided. Perhaps NIST did try to "steal",
in a moral sense, the essence of Schnorr's method by creating
a non-infringing alternative. But they still played by the
rules of the game.
>[I would add that I've personally lost my respect for you in this
>discussion, but that would be off topic.]
[Now *that is* off-topic. Shame on you, Perry.]
Dr. Schnorr argued two main points:
(1) DSS is not worthy of being patented itself.
(2) DSS should be covered by the Schnorr patent.
Maybe (1) is off-topic here. I think it's somewhat
irrelevant, and best left for historians to sort out.
I see no business reason to dispute the validity of
the DSS patent, since it has no bearing on whether
the method is covered by Schnorr.
As for (2), working around a patent by avoiding a subset
of the limiting claims is fair play with patents.
According to his argument, the broadest Schnorr patent
claim includes an element of addition, as a necessary
limitation to achieve certain goals. By arguing that
the replacement of addition with division weakens the method,
he gives evidence that DSS is distinctly different than the
broadest Schnorr claim. Inferior, perhaps. But not covered.
Dr. Schnorr wrote:
>An important question is whether the transformation of Schnorr
>signatures
>towards the DSS bears any advantage that makes out a true invention or
>whether the transform was merely designed to bypass a patent.
This is not important for (2). Whether DSS is obvious or useful
in light of other prior work, and why it was developed, has
no real bearing on whether DSS is covered by Schnorr.
Comparative structure is the important thing.
>Let us consider the "equivalence" of addition and division in the
>signature
>formula in more detail. It is true that addition and division induce
>different formulas for verification. The verification for division
>is due to ElGamal, IEEE-IT, pp. 469 -472, (1985). It uses that the
>division distributes with addition: (a + b)/c = a/c + b/c. This
>work is cited in my patent. I have great respect for the genuine
>contribution of ElGamal. My invention starts from ElGamal signatures
>and simplifies both signature generation and verification by replacing
>the division by the simpler addition.
>
>Of course you can undo my transformation and go back to division. But
>that is not a novel thing. Nobody makes us believe that
>nobody understood ElGamal signatures until they were reinvented at
>NSA/NIST. It would certainly be interesting to let independent
>cryptographic experts judge on the degree of novelty to reintroduce
>the division into the signature formula and to go back to ElGamal's
>verification formula.
Again, this argues for (1), and somewhat against (2).
It sounds like DSS is either derived from ElGamal,
or a step backwards from Schnorr toward ElGamal.
In any case, DSS does not appear to include all
the claimed elements of Schnorr, for whatever reason.
>Nobody blames me that I did not include possible DETORIATIONS of my
>invention into the patent filing. In fact the patent does not cover
>any possible DETORIATION whatsoever. On the contrary it only covers
>possible IMPROVEMENTS of the invention. It is impossible to cover in a
>patent filing all possible ways to detoriate, to complicate and to
>worsen an invention.
This sounds like a strategic error in the claims.
Nobody should blame you. Some might blame (or thank)
your patent attorney.
> [...] I argue that a broader concept of "step equivalence"
>must
>be used which includes step transformations that are known to be
>equivalent by prior art, in particular when the transformation does
>not bear an advantage. For that broader notion I have shown that the
>DSS and Schnorr signatures are step by step equivalent. The division
>in the signature formula is equivalent to the addition by prior art
>due to ElGamal.
Such a broad-winged concept of "step equivalence" won't fly
very far. If it did, one could argue that any patented
improvement to a base method, where one or more steps are
replaced by roughly equivalent but superior steps, would
automatically cover all other obvious improvements to the
base invention.
-- dpj
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:10:57