I'm hitting this problem as well with the German ID (eAU), see BZ:
Some BSI tech guidelines relating to ECCs are actually available in
english, too, e.g.:
Quoting from the former doc:
1.1. Patents and side-channel attacks
In implementations, patents and side-channel attacks play an important role.
The algorithms described in this guideline have been carefully selected to allow
and/or license-free implementations. Nevertheless, some of the described algorithms or
ticular implementations may be subject of patent rights. The BSI shall not be held
for identifying any or all such patent rights.
Implementors and security evaluators shall also pay attention to , which gives a
guidance to assess the side-channel resistance of implementations on smartcards
There is more anecdotal evidence e.g. here by ARM Mbed:
Can you optimize Brainpool curves to be as fast as the NIST curves?
Unfortunately, this is not possible. The design decision for Brainpool to
use random primes was aimed at:
- avoiding possible patent issues with fast reduction algorithms
- avoiding potential security issues with non-random primes
Nitrokey docs also show using Brainpool curves in their docs:
[...] A suitable version of GnuPG is included in the GNU/Linux
distributions Ubuntu (since 18.04), Debian (from Stretch onwards),
Arch Linux, Fedora (from Release 26 onwards) and openSUSE Tumbleweed
They apparently haven't tested their guide on Fedora in a while ;)
All of the above makes it look to me as though Brainpool curves were
specifically designed to NOT touch on any patents.
I'd be curious if any other of the big distros exclude the Brainpool curves
too. On the linked BZ it was stated that Xubuntu includes them.
It would be great if the current exclusion of those curves would be