Damien gives the following reason for not implementing ECC: "many ECC methods are patented. The NSA made the press recently for licensing these patents, something that we have neither the means nor the desire to do."

Sounds like he doesn't understand the NSA's license. Their license allows for the free sublicense of the covered ECC technology to anyone willing to state that they intend to incorporate ECC so their product will be useable by the US Gov. After that, the license allows them to leave it in their product for their other customers. So, what "means" did they lack? A willingness to say they want OpenSSH useful for US Gov't work?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/375/32875#32875