Patent license for Kyber?

Firefox Development
,
#1

I’ve got a quick question regarding the integration of Kyber into NSS that was recently done in support of #1826451.

It’s believed that U.S. patents no. 9094189 and 9246675 may apply to Kyber.

Of course, this should not be a problem, because NIST claims that it secured a license to allow anyone to use these patents for the purpose of implementing Kyber, for no charge.

However, it seems that no-one has ever actually seen this license. Due to this, Cisco has preliminarily considered Kyber unusable; they are by no means alone in their hesitation.

Therefore I ask: What is Mozilla’s position on these patents?

  • Does Mozilla hold that those patents are invalid, or otherwise inapplicable to Kyber?

  • Does Mozilla simply take NIST’s bizarre, cagey press release at face value?

  • Does Mozilla hold some other stance?

  • Has Mozilla not considered the issue at all yet?

Thanks for any responses.

I reached out to the committer privately by e-mail with this question over a month ago, but haven’t heard back, which is why I’m asking publicly now.

#2

I just tested it and confirmed that, despite the fact that this wasn’t listed in the release notes, support for Kyber was included with Firefox Release 123.0 on Tuesday, though it’s gated behind a default-disabled security.tls.enable_kyber flag.

(It seems it has not yet been included in Firefox ESR 115.8.0, which is the latest ESR as of Feb 27, 2024.)

#3

A month after I opened this thread, Eric Rescorla (former Firefox CTO) reached out to me privately and suggested that I try contacting Martin Thomson with this question.

I contacted Martin Thomson with this question 3 months ago (which was 2 months after opening this thread), but I have not yet heard back.

I had really hoped to learn Mozilla’s position on the Kyber license(s) in advance of my meeting with NIST’s legal team … knowing the “lay of the land” and having that extra context would have been a huge boon so I didn’t feel like I’m going in alone :frowning:

Admittedly the possibility is remote that Jintai Ding will revoke my license to use Kyber — thus eventually Firefox — based on a “poison pill” clause not included in NIST’s press release.

Doubly remote it is because NIST’s legal team’s representatives gave me (non-binding, non-written, non-recorded, non-indemnifying) assurances that they didn’t leave anything important out of it.

But I still *hate* the idea of using software that I’m literally not allowed to see the EULA of.