Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms DES/AES/BlowFish/TwoFish and so on. My intention is to develop application which is free of commercial copyright issues. So the question is:

  • If I will use built-in Java encryption API's (e.g. DES/AES)- does it mean that I will be free from possible commercial interests of DES/AES alike copyright holders?

Any other thoughts, meanings will be helpful also.

share|improve this question
1  
Since this is a question about copyright, and not actually about encryption, isn't this better suited for a different site such as Stackoverflow? –  Purge Dec 22 '10 at 16:42
    
@Alex not sure it's a good fit for stackoverflow, as the denizens there aren't lawyers either. –  user185 Dec 22 '10 at 17:59
    
@Graham Lee although I agree, the question is more geared towards fellow programmers, and software development than IT security. The mention of encryption really doesn't make this a security discussion. - Just my .02 –  Purge Dec 22 '10 at 18:29
1  
Not what you asked, but you shouldnt be using DES and such at all, anyway. But not for legal reasons. –  AviD Dec 23 '10 at 23:12
1  
@Alex In general, while copyright issues are definitely not a technical vulnerability, it is a risk that needs to be managed, discussed, or at least (at best) pointed towards the experts, i.e. lawyers. Though its quite rare to see lawyers involved in development :) ... That said, my point was more about the subject being cryptography libraries, and the options available - security folk should be more familiar, and know better, than developers, what is available, which options are most viable, and what pitfalls/risks are relevant to each choice. –  AviD Dec 27 '10 at 19:43

4 Answers 4

up vote 18 down vote accepted

There is no copyright on algorithms. Algorithms are like ideas; the kind of intellectual property which applies to them is patents, not copyrights. There are some cryptographic algorithms which are patented, but most are not and some used to be patented (but patents ultimately expire). Neither DES, AES, Blowfish or Twofish is patented. An example of patented symmetric encryption system is IDEA (US patent will expire in 2012). The RSA algorithm (asymmetric encryption and digital signatures) was patented, but the patent expired ten years ago. Basically, if a cryptographic algorithm is made available through an already installed Java VM, then it probably is not patented (anymore, or at all).

There can be copyrights on implementations. Using an implementation which is already there is not impacted by the copyright (it is a copyright, not a useright). You have to worry about copyright when you include external code into your application, not when you use external code provided by the installed Java VM through its published API.

Software systems can further be controlled by licenses. One could imagine a specific license which prohibits using some of the software depending on usage context or just any arbitrary condition. One could imagine such a software license on the implementation of a cryptographic algorithm. This would be the problem of whoever uses your software, not your problem. The Java VM license is the one which applies here. But, as far as I know, there is no usage restriction on the Java VM components, be they cryptographic or not. The VM vendor usually does not wish to restrict usage of his API.

Local laws may apply, especially on the matter of encryption. Depending on the country, laws may limit usage, distribution, export and/or import of software using cryptographic algorithms. The Java VM (at least, the one from Sun/Oracle) includes a relatively complex system of permissions and security rules which determines which algorithms are available, and with which key lengths. Thus, it can be assumed that whatever algorithm is made available to applications by the VM has already been tuned with regards to key lengths in order to comply with local laws. There can always be exceptions in some situations (if you are a North-Korean agent hard at work building a nuclear bomb somewhere in South Dakota, then using cryptographic algorithms, even if legally provided by the installed Java VM, might imply a few extra years of jail when the FBI gets you). In practical terms, you should check the export laws of your country if you distribute software which provides some kind of encryption service, notably if you put it on a Web site.

Summary: there is no intellectual property related worry to have about using cryptographic algorithms provided by the Java VM. You should make some inquiries about regulations on cryptographic software distribution and export. You can begin by the Wikipedia pages on crypto export and import.

share|improve this answer
1  
Here's a bit of fun history on encryption for anyone curious. PGP was considered exporting of military-grade munitions, so Zimmermann published it as a book and it became protected under free speech. en.wikipedia.org/wiki/… –  Incognito Dec 23 '10 at 16:07
1  
+1 and more, a fantastic rundown of legal and IP aspects. –  AviD Dec 23 '10 at 23:10

It's public domain like the Pythagorean theorem. Go nuts.

share|improve this answer
5  
The Pythagorean theorem is public domain now!? When did the copyright expire? :-) –  Greg Dec 22 '10 at 7:20
    
2000 yrs ago :) –  barmaley Dec 22 '10 at 10:09

As an example, from Blowfish.h, even crypto libraries may be copyright free:

  • This library is free for commercial and non-commercial use as long as
  • the following conditions are aheared to. The following conditions
  • apply to all code found in this distribution, be it the RC4, RSA,
  • lhash, DES, etc., code; not just the SSL code. The SSL documentation
  • included with this distribution is covered by the same copyright terms
  • except that the holder is Tim Hudson (tjh@mincom.oz.au).

The algorithms themselves are just maths :-)

share|improve this answer
    
Even if the library can be licenced for free ($0), copyright still protects it. Algorythms/ideas (business methods) have been patented now, but due to Bliski they will be less likely to be enforced by the US courts now. –  Andrew Russell May 10 '11 at 12:29
1  
@AndrewRussell Algorithms are abstract and cannot be patented. You need to search-replace algorithm with system in your patent application if you want it accepted. –  DeepSpace101 Jul 13 '13 at 20:36

The Android platform includes the Legion of the Bouncy Castle crypto library, you can use that and then you aren't distributing any crypto yourself - licensing the Bouncy Castle code for distribution is handled by the open handset alliance. Notice that there still may be export limitations - for instance, in the US a product that uses encryption even if it doesn't contain the encryption algorithms itself is still a controlled product under the EAR.

share|improve this answer
    
Never knew... but there's nonthing in official developer docs about BouncyCastle, strange... –  barmaley Dec 24 '10 at 7:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.