Given that Bouncy Castle is an Open Source project, it's entirely possible that the contents contains implementations protected by various patents.

  • Since it's possible for the patent holder to sue the company that made it (assuming they are collecting revenue from it) and the end user of such software, what aspects of the software are "known safe" or "known unsafe" with regard to unencumbered use by patents?


Many authenticated encryption modes for Block Ciphers are protected by various patents. Examples of such modes are XCBC, IACBC, IAPM, OCB, EAX, CWC, CCM, and GCM.

Up until January 2013, OCB mode had a restricted license for commercial implementations, and in theory could have put them at risk of a lawsuit.

Even though the OCB mode IP license has been relaxed somewhat, it's still important to know which implementations are safe and unsafe for general use

migrated from security.stackexchange.com May 21 '13 at 6:17

This question came from our site for information security professionals.

  • Patents give the owner the right to try to stop someone from making, selling, offering for sale, using or importing. Their is no requirement that the alleged infringer is collecting money for it. Making and using do not necessarily have commercial connotations. – George White May 21 '13 at 20:30
  • Perhaps I need to revise (assistance wanted). My understanding is that violators of GPL software could include the end-customers where Microsoft could sue companies that use Linux. Taking that as an example, perhaps the patent holder of Bouncy Castle - patented software might be able to sue the customer of those DLLs. – random65537 May 21 '13 at 20:33
  • Yes, that is correct - I made my response as a comment because it was not an actual answer to the question. I was just pointing out that the "sue the company that made it (assuming they are collecting revenue from it)" in your question seemed to make the presumption that money needed to change hands for patent infringement and it does not. If you make it and give it away it is still making it. And, as you point out, a user can be sued even if they got the thing for fee. – George White May 21 '13 at 21:07

As you said, Bouncy Castle contains many different implementations, some of which may be patented. For example, from personal use, I know Bouncy Castle includes some ECC methods and curves that could be covered by various patents.

However, since BC contains so many implementations, it's a very open-ended (and difficult to answer with certainty) question to ask which parts of it are covered by patents. The better way to go about it would be to look at each specific crypto method you want to use, and check if that is patented. If it turns out to be patented, it won't matter if you're using BC or any other library to implement it, because any unlicensed use would still be infringing.

On the other hand, if your method of interest is not patented, it might be safe to use that specific method, despite the inclusion of other potentially patented methods in the library. The theory is that since you are not using those other methods, you should not have to license them. The problem is, if you distribute the library along with a product, and that library contains patented methods that you do not use, an argument could still be made that you are distributing a product infringing patented methods, since infringement covers "using, making or selling" (and distribution falls under making or selling). I personally wouldn't buy that argument, but it has not been tested in court as far as I know, so it's a bit of a gray area.

The safe bet here would be to ensure the methods you want to use are not patented, and using a tool (such as ClassDep, maybe?) to prune out unused classes and dependencies so that your final jar does not contain any potentially infringing components. This is slightly more difficult for a library like BC because it uses a lot of reflection to instantiate the necessary classes, but it should be tractable with some trial-and-error.

On the other hand, if you are never distributing the library (e.g. using it internally on your servers), you should be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.