How important is ECDSA to Tribler? How about removing it?

[mikeym]

Hi,

I've just been looking into installing Tribler in Fedora 16 and I realised that it was going to be a massive headache because of it's use of ECDSA which has been removed from Fedora because of the outstanding patents surrounding this technology. Is this something that it could do without? If so why not open it up to open source users by eliminating it?

[Niels]

ECDSA is elliptic curve right? We actually use it because it produces smaller signatures compared to 'normal' scheme's. We could try to use combination of hashing and the signing the hash to see if we can get a similar 'security' in signing messages.

[mikeym]

Yes it's the elliptic curve algorithm. Fedora and I assume other Red Hat based distributions (well I assume since it's been put in place by the Red Hat legal team) have ECC disabled in OpenSSL.

Here is a discussion about the blockage in Fedora:

https://bugzilla.redhat.com/show_bug.cgi?id=612265

And here are some links to discussion about the state of patenting on Elliptic Curve Cryptography:

http://en.wikipedia.org/wiki/ECC_patents
http://cr.yp.to/ecdh/patents.html

It's apparently under review by the legal team but there's no time frame on anything happening about it.

[Niels]

From what I'm reading, most people are actually saying its not really patented.
If it actually was, then we could consider swapping it for a different technique. As it stands, I guess we will not.
Currently we support Ubuntu, which does have ec enabled in its openssl builds.