9

I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms DES/AES/BlowFish/TwoFish and so on. My intention is to develop application which is free of commercial copyright issues. So the question is:

  • If I will use built-in Java encryption API's (e.g. DES/AES)- does it mean that I will be free from possible commercial interests of DES/AES alike copyright holders?

Any other thoughts, meanings will be helpful also.

10
  • 1
    Since this is a question about copyright, and not actually about encryption, isn't this better suited for a different site such as Stackoverflow?
    – Purge
    Commented Dec 22, 2010 at 16:42
  • @Alex not sure it's a good fit for stackoverflow, as the denizens there aren't lawyers either.
    – user185
    Commented Dec 22, 2010 at 17:59
  • @Graham Lee although I agree, the question is more geared towards fellow programmers, and software development than IT security. The mention of encryption really doesn't make this a security discussion. - Just my .02
    – Purge
    Commented Dec 22, 2010 at 18:29
  • 1
    Not what you asked, but you shouldnt be using DES and such at all, anyway. But not for legal reasons.
    – AviD
    Commented Dec 23, 2010 at 23:12
  • 1
    @Alex In general, while copyright issues are definitely not a technical vulnerability, it is a risk that needs to be managed, discussed, or at least (at best) pointed towards the experts, i.e. lawyers. Though its quite rare to see lawyers involved in development :) ... That said, my point was more about the subject being cryptography libraries, and the options available - security folk should be more familiar, and know better, than developers, what is available, which options are most viable, and what pitfalls/risks are relevant to each choice.
    – AviD
    Commented Dec 27, 2010 at 19:43

4 Answers 4

23

There is no copyright on algorithms. Algorithms are like ideas; the kind of intellectual property which applies to them is patents, not copyrights. There are some cryptographic algorithms which are patented, but most are not and some used to be patented (but patents ultimately expire). Neither DES, AES, Blowfish or Twofish is patented. An example of patented symmetric encryption system is IDEA (US patent will expire in 2012). The RSA algorithm (asymmetric encryption and digital signatures) was patented, but the patent expired ten years ago. Basically, if a cryptographic algorithm is made available through an already installed Java VM, then it probably is not patented (anymore, or at all).

There can be copyrights on implementations. Using an implementation which is already there is not impacted by the copyright (it is a copyright, not a useright). You have to worry about copyright when you include external code into your application, not when you use external code provided by the installed Java VM through its published API.

Software systems can further be controlled by licenses. One could imagine a specific license which prohibits using some of the software depending on usage context or just any arbitrary condition. One could imagine such a software license on the implementation of a cryptographic algorithm. This would be the problem of whoever uses your software, not your problem. The Java VM license is the one which applies here. But, as far as I know, there is no usage restriction on the Java VM components, be they cryptographic or not. The VM vendor usually does not wish to restrict usage of his API.

Local laws may apply, especially on the matter of encryption. Depending on the country, laws may limit usage, distribution, export and/or import of software using cryptographic algorithms. The Java VM (at least, the one from Sun/Oracle) includes a relatively complex system of permissions and security rules which determines which algorithms are available, and with which key lengths. Thus, it can be assumed that whatever algorithm is made available to applications by the VM has already been tuned with regards to key lengths in order to comply with local laws. There can always be exceptions in some situations (if you are a North-Korean agent hard at work building a nuclear bomb somewhere in South Dakota, then using cryptographic algorithms, even if legally provided by the installed Java VM, might imply a few extra years of jail when the FBI gets you). In practical terms, you should check the export laws of your country if you distribute software which provides some kind of encryption service, notably if you put it on a Web site.

Summary: there is no intellectual property related worry to have about using cryptographic algorithms provided by the Java VM. You should make some inquiries about regulations on cryptographic software distribution and export. You can begin by the Wikipedia pages on crypto export and import.

2
  • 1
    Here's a bit of fun history on encryption for anyone curious. PGP was considered exporting of military-grade munitions, so Zimmermann published it as a book and it became protected under free speech. en.wikipedia.org/wiki/…
    – Incognito
    Commented Dec 23, 2010 at 16:07
  • 1
    +1 and more, a fantastic rundown of legal and IP aspects.
    – AviD
    Commented Dec 23, 2010 at 23:10
6

The Android platform includes the Legion of the Bouncy Castle crypto library, you can use that and then you aren't distributing any crypto yourself - licensing the Bouncy Castle code for distribution is handled by the open handset alliance. Notice that there still may be export limitations - for instance, in the US a product that uses encryption even if it doesn't contain the encryption algorithms itself is still a controlled product under the EAR.

1
  • Never knew... but there's nonthing in official developer docs about BouncyCastle, strange...
    – Barmaley
    Commented Dec 24, 2010 at 7:43
4

It's public domain like the Pythagorean theorem. Go nuts.

2
  • 5
    The Pythagorean theorem is public domain now!? When did the copyright expire? :-)
    – Greg
    Commented Dec 22, 2010 at 7:20
  • 2000 yrs ago :)
    – Barmaley
    Commented Dec 22, 2010 at 10:09
1

As an example, from Blowfish.h, even crypto libraries may be copyright free:

  • This library is free for commercial and non-commercial use as long as
  • the following conditions are aheared to. The following conditions
  • apply to all code found in this distribution, be it the RC4, RSA,
  • lhash, DES, etc., code; not just the SSL code. The SSL documentation
  • included with this distribution is covered by the same copyright terms
  • except that the holder is Tim Hudson ([email protected]).

The algorithms themselves are just maths :-)

2
  • Even if the library can be licenced for free ($0), copyright still protects it. Algorythms/ideas (business methods) have been patented now, but due to Bliski they will be less likely to be enforced by the US courts now. Commented May 10, 2011 at 12:29
  • 1
    @AndrewRussell Algorithms are abstract and cannot be patented. You need to search-replace algorithm with system in your patent application if you want it accepted. Commented Jul 13, 2013 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .