DETAILED ACTION
Applicant’s preliminary amendment filed 4/22/2025 has been fully considered.
Claims 1-11 have been examined. Claims 12-15 have been canceled.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
It is noted that no Information Disclosure Statement has been filed.
No IDS has been received for this application. Applicants are reminded of the Duty to Disclose, from section 2001 of the MPEP (emphasis added). MPEP 2001 Duty of Disclosure, Candor, and Good Faith [R-08.2012] 37 C.F.R. 1.56 Duty to disclose information material to patentability.
(a) A patent by its very nature is affected with a public interest. The public interest is best served, and the most effective patent examination occurs when, at the time an application is being examined, the Office is aware of and evaluates the teachings of all information material to patentability. Each individual associated with the filing and prosecution of a patent application has a duty of candor and good faith in dealing with the Office, which includes a duty to disclose to the Office all information known to that individual to be material to patentability as defined in this section.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-11 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
The claims are generally narrative and indefinite, failing to conform with current U.S. practice. They appear to be a literal translation into English from a foreign document and are replete with grammatical and idiomatic errors. It is indefinite what the intended metes and bounds of the claims is, i.e. it is indefinite what the intended metes and bounds of “a device including one input adapted to receive”, “getting a scalar multiplication”, “proceeding with a scalar multiplication”, “integer being worth 1”, “a degree equal to respectively said”, the usage of parenthesis are intended to be.
This is not intended to be a complete list of such indefiniteness issues.
The dependent claims included in the statement of rejection but not specifically addressed in the body of the rejection have inherited the deficiencies of their parent claim and have not resolved the deficiencies. Therefore, they are rejected based on the same rationale as applied to their parent claims above.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-11 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) mathematical calculations.
This judicial exception is not integrated into a practical application because they are broad enough to cover performing mathematical calculations in the mind or with pen/paper, other than the generic computer components and are also directed to the mathematical concepts grouping of abstract ideas.
Regarding Prong One, these steps, as drafted, form a process that under its broadest reasonable interpretation covers performance of the limitation in the mind or with pen/paper but for the recitation of generic computer components. That is, other than reciting “a device”, nothing in the claim element precludes the step from practically being performed in the human mind. For example, but for the “a device” language, the claim encompasses a user receiving parameters and encrypting/signing short strings as introduction to elementary encryption classes are taught.
Regarding Prong Two, there are no additional element(s) or a combination of elements in the claim that apply, rely on, or use the judicial exception in a manner that imposes a meaningful limit on the judicial exception, such that it is more than a drafting effort designed to monopolize the exception.
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the claims only use generic computer components. Mere instructions to apply an exception using generic components cannot provide an inventive concept. Additionally, the mere nominal recitation of a generic processor does not take the claim limitation out of the mental processes grouping and the mathematical concepts grouping of abstract ideas. Thus, the claims recite a mental process and are not patent eligible.
The claims are directed to well-understood, routine, and conventional activity as evidenced by the “background of the invention” section and the cited references.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-11 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Harvey (20240223368).
Regarding claim 1, Harvey teaches A device for generating a public key (KpubEd) from a private key (Kpriv) in elliptic curve cryptography, said device including (abstract, fig.6, par.137-140):
at least one input adapted to receive data (Kpriv, h, s) representative of said private key, and at least one parameter (q, n, a, d, GEd) defining a first elliptic curve on a finite field having a field order (p) and a first base point (GEd) located on said first elliptic curve, said first elliptic curve being of a twisted Edwards curve type (par.137-140, generating key based on curve parameters);
at least one processor configured for computing data (s.GEd, KpubEd) representative of said public key (KpubEd) from said data representative of said private key, by getting a scalar multiplication (s. GEd) on said first elliptic curve of said first base point (GEd) by a scalar (s) derived from said private key (par.137-140, calculate key based on parameters of one curve); and
at least one output adapted to provide said data representative of said public key for securing digital communications;
wherein said at least one input is adapted to receive at least one parameter (q, n, A, B, GM), defining a second elliptic curve birationally equivalent to said first elliptic curve (Ed25519) via an isomorphism and a second base point (GM) located on said second elliptic curve and corresponding to said first base point (GEd) with respect to said isomorphism, said second elliptic curve being of a Montgomery curve type; and
wherein said at least one processor is configured for proceeding with a scalar multiplication (s. GM; s '.GM) on said second elliptic curve of said second base point (GM) by at least one adjusted scalar (s; s') among said scalar (s) derived from said private key and at least one division (s') modulo said field order (p) of said scalar (s) by respectively at least one adjustment integer (L) greater than 1, said at least one adjustment integer being worth 1 when said at least one adjusted scalar includes said scalar, and for converting a resulting point of said scalar multiplication on said second elliptic curve to said scalar multiplication (s. GEd) on said first elliptic curve by at least one isogeny, said at least one isogeny having a degree equal to respectively said at least one adjustment integer and mapping said second base point to at least one scalar multiplication (L.GEd) of said first base point by respectively said at least one adjustment integer (par.137-140, converting points from one curve to another, par.144-151, transform and inverse transforms from one curve to another).
Regarding claim 2, Harvey teaches A device for generating a signature (R, S) associated with a message (msg) from a private key (Kpriv) in elliptic curve cryptography, said device including (abstract, fig.6, par.137-140):
at least one input adapted to receive data (Kpriv, h, s, Prefix, r) representative of said private key and of said message, and at least one parameter (q, n, a, d, GEd), defining a first elliptic curve on a finite field having a field order (p) and a first base point (GEd) located on said first elliptic curve, said first elliptic curve being of a twisted Edwards curve type (par.137-140, generating parameters based on curve parameters);
at least one processor configured for computing data (r.GEd, R, k, S) representative of said signature from said data representative of said private key and of said message, by getting a scalar multiplication (r. GEd)on said first elliptic curve of said first base point (GEd) by a nonce value (r) (par.137-140, calculate parameters based on parameters of one curve); and
at least one output adapted to provide said data representative of said signature for securing digital communications;
wherein said at least one input is adapted to receive at least one parameter (q, n, A, B, GM), defining a second elliptic curve birationally equivalent to said first elliptic curve via an isomorphism and a second base point (GM) located on said second elliptic curve and corresponding to said first base point (GEd) with respect to said isomorphism, said second elliptic curve being of a Montgomery curve type; and
wherein said at least one processor is configured for proceeding with a scalar multiplication (r. GM; s '.GM) on said second elliptic curve of said second base point (GM) by at least one adjusted nonce value (r;r') among said nonce value (r) and at least one division (r') modulo said field order (p) of said nonce value (r) by respectively at least one adjustment integer (L) greater than 1, said at least one adjustment integer being worth 1 when said at least one adjusted nonce value includes said nonce value, and for converting a resulting point of said scalar multiplication on said second elliptic curve to said scalar multiplication (r. GEd) on said first elliptic curve by at least one isogeny, said at least one isogeny having a degree equal to respectively said at least one adjustment integer and mapping said second base point to at least one scalar multiplication (L.GEd) of said first base point by respectively said at least one adjustment integer (par.137-140, converting points from one curve to another, par.144-151, transform and inverse transforms from one curve to another).
Regarding claim 3, Harvey teaches characterized in that said device for generating a signature includes a device for generating a public key compliant with claim 1 (fig.6, par.137-140).
Regarding claim 4, Harvey teaches characterized in that said at least one processor is configured for proceeding with said scalar multiplication (s.GM, r.Gm;s'.GM, r'.GM) on said second elliptic curve (Curve25519) in an expanded coordinate representation involving at least three coordinates (U:V:Z) instead of two coordinates (u, v) as in an affine representation, said expanded coordinate representation being adapted to switch between said affine representation on said first elliptic curve and said expanded coordinate representation on said second elliptic curve, so that said scalar multiplication on said second elliptic curve is effected in said expanded coordinate representation without modular inversion, and for converting said expanded coordinate representation of said resulting point (s. GM, r. GM; s '.GM, r'.GM) on said second elliptic curve to said affine representation of said scalar multiplication (s. GEd, r. GEd)on said first elliptic curve (Ed25519) (par.136-140).
Regarding claim 5, Harvey teaches characterized in that said expanded coordinate representation is a projective coordinate representation, in which a point defined by said at least three coordinates is left unchanged by multiplying said at least three coordinates by a same coefficient, and said at least one processor is configured for converting with a single modular inversion said expanded coordinate representation of said resulting point (s. Gm, r. Gm; s '.Gm, r'.Gm) on said second elliptic curve (Curve25519) to said affine representation of said scalar multiplication (s.GEd, r.GEd) on said first elliptic curve (Ed25519) (par.136-140).
Regarding claim 6, Harvey teaches A device for verifying a signature (R, S) associated with a message (msg) from a public key (KpubEd) in elliptic curve cryptography, said device including (abstract):
at least one input (41, 401; 51, 501) adapted to receive data (R, R'Ed, S, KpubEd, Kpub'Ed, kO) representative of said signature, of said public key and of said message, and at least one parameter (q, n, a, d, GEd) defining a first elliptic curve and a first base point (GEd) located on said first elliptic curve, said first elliptic curve being of a twisted Edwards curve type, said signature (R, S) comprising a scalar part associated with a check value (S) and a curve point part (R) representative of a check curve point (R 'Ed) of said first elliptic curve, and said public key (KpubEd) being representative of a public key point (Kpub'Ed) of said first elliptic curve (par.94-98, receiving parameters from one curve);
at least one processor configured for verifying consistency between said signature and said message by an equality check corresponding to said first elliptic curve, involving terms based respectively on said signature curve point part (R 'Ed; R), on a scalar multiplication (S.GEd) of said first base point by a base point multiplier (S; z.S' mod n) derived from at least said signature scalar part, and on a scalar multiplication (kO.Kpub'Ed) of said public key point by a public key multiplier (kO; R.S' mod n) derived from at least said signature curve point part (R), at least one (kO; z.S-1 mod n) of said base point multiplier and public key multiplier being also derived from said message (msg) (par.97-103, perform scalar operations on points); and
at least one output adapted to provide an authentication outcome (Auth) of said equality check for securing digital communications; said at least one input is adapted to receive at least one parameter (q, n, A, B, GM), defining a second elliptic curve birationally equivalent to said first elliptic curve via an isomorphism and a second base point (GM) located on said second elliptic curve and corresponding to said first base point (GEd) with respect to said isomorphism, said second elliptic curve being of a Montgomery curve type; and said at least one processor is configured for determining from said public key (KpubEd) a converted public key point (Kpub 'M) of said second elliptic curve corresponding to said public key point (Kpub'Ed) of said first elliptic curve with respect to said isomorphism, for proceeding with scalar multiplications (S.GM, kO.Kpub'M) on said second elliptic curve of said second base point (GM) by said base point multiplier (S) and of said converted public key point (Kpub 'M) by said public key multiplier (k0), and for carrying out said equality check in a same one of said first elliptic curve and second elliptic curve, on the ground of said scalar multiplications and of said check curve point (R 'Ed) (par.100-111, converting values from one curve to another for more efficient operations than traditional EdDSA).
Regarding claim 7, Harvey teaches characterized in that said at least one processor is configured for determining in said second elliptic curve said converted public key point (Kpub'M) and a converted check curve point (R 'M) corresponding to said check curve point (R 'Ed)of said first elliptic curve with respect to said isomorphism, in an expanded coordinate representation on said second elliptic curve involving at least three coordinates (U:V:Z), said expanded coordinate representation being adapted to switch between an affine representation involving two coordinates (x, y) on said first elliptic curve and said expanded coordinate representation on said second elliptic curve, and for proceeding without modular inversion with said scalar multiplications (S.GM, kO.Kpub 'M) as well as said equality check in said expanded coordinate representation on said second elliptic curve (par.136-140).
Regarding claim 8, Harvey teaches characterized in that said at least one processor is configured for converting without modular inversion an affine representation involving two coordinates (x, y) in said first elliptic curve of said public key point (Kpub'Ed) to a projective homogeneous coordinate representation (Kpub'M) in said second elliptic curve involving at least three coordinates (U:V:Z), said projective homogeneous coordinate representation being such that a point defined by said at least three coordinates (U:V:Z) is left unchanged by multiplying said at least three coordinates by a same coefficient (par.136-140).
Regarding claim 9, Harvey teaches characterized in that said at least one processor is configured for proceeding with said scalar multiplications (S.GM, kO.Kpub'M) on said second elliptic curve by a Montgomery ladder approach modified by processing coordinates (U1, Z1, U2, Z2, U, V, Z) entirely expressed in said projective homogeneous coordinate representation (par.149-154).
Regarding claim 10, Harvey teaches characterized in that said at least one processor is configured for effecting on said first elliptic curve via said second elliptic curve an EdDSA procedure, said base point multiplier corresponding to said check value (S) and said public key multiplier being derived from said curve point part (R), said public key (KpubEd) and said message (msg) (par.79-82).
Regarding claim 11, Harvey teaches characterized in that said first elliptic curve and said second elliptic curve are respectively birationally equivalent elliptic curves over a prime field defined by the prime number 2255 - 19, said first elliptic curve being defined in affine coordinates x, y by: -x2+y2= 1 - (121665/121666) x2y2 and being associated with said first base point (GEd) having an ordinate y equal to 4/5, and said second elliptic curve being defined in affine coordinates u, v by: v2 = u3+486662u2+u and being associated with said second base point (GM) having an abscissa u equal to 9 (par.158-166, 226-235).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: the remaining references put forth on the PTO-892 form are directed to EdDSA improvements. Grossschadl (NPL “Lightweight EdDSA Signature Verification for the Ultra-Low-Power Internet of Things”).
Mehrabi et al. (NPL “Low-Cost, Low-Power FPGA Implementation of ED25519 and CURVE25519 Point Multiplication”) teaches Twisted Edwards curves have been at the center of attention since their introduction by Bernstein et al. in 2007. The curve ED25519, used for Edwards-curve Digital Signature Algorithm (EdDSA), provides faster digital signatures than existing schemes without sacrificing security. The CURVE25519 is a Montgomery curve that is closely related to ED25519. It provides a simple, constant time, and fast point multiplication, which is used by the key exchange protocol X25519. Software implementations of EdDSA and X25519 are used in many web-based PC and Mobile applications. In this paper, we introduce a low-power, low-area FPGA implementation of the ED25519 and CURVE25519 scalar multiplication that is particularly relevant for Internet of Things (IoT) applications. The efficiency of the arithmetic modulo the prime number 2255 - 19, in particular the modular reduction and modular multiplication, are key to the efficiency of both EdDSA and X25519. To reduce the complexity of the hardware implementation, we propose a high-radix interleaved modular multiplication algorithm. One benefit of this architecture is to avoid the use of large-integer multipliers relying on FPGA DSP modules.
Longa (20090323933) teaches A method of scalar multiplication for use in elliptic curve-based cryptosystems (ECC) is provided. Scalars are represented using a generic multibase form combined with the non-adjacency property, which greatly reduces the nonzero density in the representation. The method allows for flexibly selecting an unrestricted number of bases and their weight in the representation according to the particular characteristics of a setting, in such a way that computing costs are minimized. A simple, memory-friendly conversion process from binary to multibase representation and an inexpensive methodology to protect the multibase scalar multiplication against simple-side channel attacks are also provided.
Schwarz (20200266999) teaches To generate and/or verify a digital signature, an authentication technique is used. Example authentication techniques include the Elliptic Curve Digital Signature Algorithm (ECDSA), the Edwards-curve Digital Signature Algorithm (EdDSA), as well as others. Each authentication technique is based on mathematical constructs. For instance, the Elliptic Curve Digital Signature Algorithm and the Edwards-curve Digital Signature Algorithm use elliptic curves in generating and/or verifying a digital signature.
Bygrave (WO2023175329) teaches obtaining a projective coordinate representation of a first point on a first elliptic curve defined on a finite field, wherein the finite field is defined by a field order; performing a first operation using the projective coordinate representation of the first point to determine a projective coordinate representation of a second point on the first elliptic curve; and obtaining an affine coordinate representation of the second point, wherein when the second point is an identity point, the affine coordinate representation comprises an affine coordinate which has a value greater than or equal to the field order.
Harvey (WO2022243689)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to David García Cervetti whose telephone number is (571)272-5861. The examiner can normally be reached Monday-Friday 8AM-5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, HADI S ARMOUCHE can be reached at (571)270-3618. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/David Garcia Cervetti/Primary Examiner, Art Unit 2409
