A Texas company is suing some of the biggest names in tech and retail, claiming their HTTPS websites infringe an encryption patent titled "Auto-Escrowable and Auto-Certifiable Cryptosystems." CryptoPeak Solutions has filed about six dozen cases in all, and they began hitting the patent-troll friendly venue of the Eastern District of Texas in July.
The patent's abstract describes the invention, granted in 2001:
A method is provided for an escrow cryptosystem that is overhead-free, does not require a cryptographic tamper-proof hardware implementation (i.e., can be done in software), is publicly verifiable, and cannot be used subliminally to enable a shadow public key system. A shadow public key system is an unescrowed public key system that is publicly displayed in a covert fashion. The keys generated by the method are auto-recoverable and auto-certifiable (abbrev. ARC). The ARC Cryptosystem is based on a key generation mechanism that outputs a public/private key pair and a certificate of proof that the key was generated according to the algorithm. Each generated public/private key pair can be verified efficiently to be escrowed properly by anyone. The verification procedure does not use the private key. Hence, the general public has an efficient way of making sure that any given individual's private key is escrowed properly, and the trusted authorities will be able to access the private key if needed. Since the verification can be performed by anyone, there is no need for a special trusted entity, known in the art as a “trusted third party”. The cryptosystem is overhead free since there is no additional protocol interaction between the user who generates his or her own key, and the certification authority or the escrow authorities, in comparison to what is required to submit the public key itself in regular certified public key systems. Furthermore, the system is designed so that its internals can be made publicly scrutinizable (e.g., it can be distributed in source code form). This differs from many schemes which require that the escrowing device be tamper-proof hardware.
The latest batch of cases was lodged November 25. The cases name AT&T, Costco, Expedia, GoPro, Groupon, Netflix, Pinterest, Shutterfly, Starwood Hotels, Target, and Yahoo, among others. All the lawsuits include virtually identical language.
"Defendant has committed direct infringement by its actions that comprise using one or more websites that utilize Elliptic Curve Cryptography (“ECC”) Cipher Suites for the Transport Layer Security (“TLS”) protocol (the “Accused Instrumentalities”)," according to the lawsuits.
Some of CryptoPeak's targets are fighting the suit, which seeks damages and royalties. Others, like Scotttrade, are settling (PDF) out of court, saying "all matters in controversy between CryptoPeak and Scottrade have been settled, in principle."
Charles Schwab, on the other hand, claims (PDF) the patent is "invalid and/or unenforceable." The stock trading company said in a court filing that CryptoPeak "has misused the patent by attempting to enforce it despite knowing that it is invalid and/or not infringed."
Netflix is also crying foul. "The defect in these claims is so glaring that CryptoPeak’s only choice is to request that the court overlook the express words of the claims, construe the claims to read out certain language, or even correct the claims," Netflix said (PDF) in a court filing.
Listing image by EFF Photos
reader comments
139