T 0108/12 (Key agreement and transport protocol with implicit signatures/CERTICOM) 29-09-2015

1. Admissibility

Both appeals comply with Articles 106 to 108 EPC (see Facts and Submissions, point II above). They are therefore admissible.

2. Articles 100(c), 76(1) and 123(2) EPC

Since the patent in suit is based on a divisional application, according to Article 100(c) EPC the granted set of claims must find a basis in the earlier (parent) application as filed, i.e. in document WO 98/18234 A1 (Article 76(1) EPC).

References to the original disclosure or original claims, description or drawings are to be understood as referring to the disclosure of the earlier application 96944186.4 as filed, published as WO 98/18234 A1.

Proprietor's main request

3. The decision under appeal followed the opponent's (appellant 2) request and rejected the main request of the proprietor, because claim 1 added subject-matter to the content of the earlier application as filed, contrary to the provisions of Article 100 c) EPC.

3.1 According to claim 1 of the main request a first function f(alpha) is exponentiated by the first correspondent A to provide a first exponentiated function f(alpha)**(g(x)) (step i) and the second correspondent B exponentiates a second function which is the same function f(alpha) to provide a corresponding second exponentiated function f(alpha)**(g(y)) (step iv). In original claim 1, however, the two functions and the basis in the two exponentiated functions were specified in a different way, namely f(alpha), f'(alpha) and f(alpha)**(g(x)), f'(alpha)**(g(y)), respectively.

3.2 The proprietor (appellant 1) argued that in all embodiments as well as according to original claim 7 the two functions f(alpha), f'(alpha) were indeed the same function f(alpha) and that in original claim 1 the two functions were already meant to be the same. When reading original claim 1 together with any of the protocols/embodiments, it was clear that the functions could be the same and arbitrary (see e.g. page 6, point 3 of the statement setting out the grounds of appeal dated 4 April 2012). Therefore the embodiments and original claim 7 provided a basis for claim 1 of the main request.

The proprietor further argued that the feature that the functions f(alpha) and f'(alpha) could not only be the same, but could also be equal to the identity function f(alpha)=alpha, represented a further feature which was not essential to the solution of the problem solved by the invention, namely bandwidth reduction.

3.3 The board agrees with the decision under appeal which reasoned that the specification of f(alpha) and f'(alpha) in the original application implied the use of two different functions. Even if the wording of original claim 1 was interpreted to the effect that f(alpha) and f'(alpha) can be different functions as well as comprising the special case of both functions being the same, the limitation in present claim 1 to only having the same functions is a selection for which no direct and unambiguous disclosure is found.

Claims 6 and 7 of the earlier application provide a basis for a feature that f(alpha)=alpha and f'(alpha)=alpha. The board agrees with the opponent's argument that specifying that the two functions f(alpha) and f'(alpha) are arbitrary but the same is an intermediate generalisation between the special case that both functions are the identity function and the general case that the two functions are arbitrary and may be different. As the description does not contain any teaching as to the nature of these functions, apart from the fact that they may be the identity function, irrespective of the skilled person's knowledge of mathematics or cryptography there is no basis for an intermediate generalisation that the two functions are the same, arbitrary single function. Nor is there a basis for splitting the feature f(alpha)=f'(alpha)=alpha into a first feature that the functions are identical f(alpha)=f'(alpha) and a second feature that they are the identity function f(alpha)=f'(alpha)=alpha. This first feature without having the second feature at the same time constitutes new technical information that cannot be derived from the original application in the sense of decision T 461/05 referred to by both parties (see e.g. page 7 of the proprietor's statement setting out the grounds of appeal, and page 4 onwards of the opponent's letter dated 20 August 2012). In particular, the second feature is regarded as necessary for carrying out the invention and therefore cannot be regarded as non-essential.

3.4 In the board's judgement, there is no basis for removing the second feature as not essential. Consequently, claim 1 of the main request adds subject-matter to the original disclosure of the earlier application, contrary to Article 100 (c) EPC.

Proprietor's auxiliary requests 1 to 3

4. Since claim 1 according to these requests comprises the same feature objected to with regard to the main request (see point 3 above), claim 1 of these requests also adds subject-matter to the original disclosure of the earlier application, contrary to Article 100 (c) EPC.

Proprietor's auxiliary request 4

5. The opponent objected to claim 1 under Articles 123(2) (or 76(1), respectively) and 100(c) EPC with regard to step ii) of generating a first signature containing the additional formulation "said first correspondent A maintaining said first signature private to itself", and step iv) containing the corresponding formulation "said second correspondent B maintaining said second signature SB private to itself".

5.1 In the decision under appeal the basis for this amendment was found in protocols 1', 2', 1'', and 1''' of the original description, where it was argued that the signatures were in fact not transmitted, as well as in the passages "the signatures need not be transmitted" (page 8, lines 24-25), "the transmission of SA and SB is avoided" (page 9, line 5), "avoiding the need to transmit the signature" (page 10, lines 4-5), and "not necessary to send the signature components" (page 13, lines 13-14). Moreover, the last step of original claim 1 already referred to private information which corresponded to the signatures in protocols 1', 2', 1'', and 1'''.

5.2 The opponent essentially argued (see e.g. point I. 4 of the statement setting out the grounds of appeal and point II.2 onwards of letter dated 7 January 2013, repeated during oral proceedings) that in the original section "disclosure of the invention" on pages 4 and 5 of the original application the signature was explicitly transmitted to the correspondent, which was in contrast to the present set of claims. Private information was disclosed to be accessible to both correspondents A and B (see original claim 1, last line "information that is private to themselves" - emphasis added). The signature was not disclosed as private information, only the random number was to be held private (see original application, page 5, lines 1 to 3). With regard to the signature there were disclosed embodiments either with its transmission or without its transmission. Furthermore, the act of keeping something private would imply measures to keep the information secret, whereas not transmitting would merely avoid such an activity without further measures regarding secrecy.

5.3 The board concurs with the opponent's arguments, in particular that the information alleged to be private is rather the random integer than the signature itself (see original application, page 5, lines 1 to 3). Maintaining something private, i.e. secret, involves more than merely not transmitting such information. While there are several passages relating to different protocols directly and unambiguously disclosing that a transmission of the respective signatures SA and SB can be avoided (see e.g. "the signatures [...] need not be transmitted" on original page 8, lines 24-25; "the transmission of SA and SB is avoided" on original page 9, line 5; "avoiding the need to transmit the signature" on original page 10, lines 4-5 and "not necessary to send the signature components" on original page 13, lines 13-14), there is hence no direct and unambiguous disclosure for signatures SA and SB to be maintained private.

5.4 Therefore the original (earlier) application documents do not provide a direct and unambiguous disclosure for claim 1, step ii) of generating a first signature containing the additional formulation "said first correspondent A maintaining said first signature private to itself", and step iv) containing the corresponding formulation "said second correspondent B maintaining said second signature SB private to itself".

5.5 Independent claim 12 contains the same feature "maintaining the first signature private to itself" and therefore suffers from the same deficiency.

5.6 Claims 1 and 12 according to this request therefore do not fulfil the requirements of Article 100(c) and Article 76(1) EPC.

Proprietor's auxiliary requests 5 to 11

6. Since claim 1 according to these requests comprises the same features objected to with regard to auxiliary request 4 (see point 5 above), claim 1 of these requests also adds subject-matter to the original disclosure of the earlier application, contrary to Article 100 (c) EPC.

Proprietor's auxiliary request 12

7. In claim 1 of this request, step ii) of generating a first signature in claim 1 as granted containing the formulation "said first correspondent A maintaining said first signature private to itself" has been replaced by "said first correspondent A avoiding transmission of said first signature". Likewise, step iv) of claim 1 containing the corresponding formulation "said second correspondent B maintaining said second signature SB private to itself" has been replaced by "said second correspondent B avoiding transmission of said second signature".

7.1 The opponent (appellant 2) objected to this amendment, on the ground that it constituted an undue broadening of the subject-matter of claim 1 as granted in contrast to the requirements of Article 123(3) EPC.

7.2 The proprietor (appellant 1) argued that the amendment was merely a redefinition of a term in language closer to that of the original application, and in which the skilled person would not see a different teaching. No inappropriate advantage was achieved in the light of the criteria mentioned in decision G 1/93 (EPO OJ 1994, 541).

7.3 The proprietor further argued that the objection was surprising, since it was raised for the first time during oral proceedings. The board did not agree in this regard, since the opponent had already referred to G 1/93 in the written proceedings (see e.g. grounds of appeal dated 23 March 2012, section 3.1 on pages 13 and 14) and the issue of a conflict between Articles 123(2) and 123(3) EPC therefore had already been raised before the summons for oral proceedings. The proprietor therefore had to be prepared to discuss this issue.

7.4 The board agrees with the opponent that according to the description of the earlier application only one embodiment actually mentions not sending signatures (see protocol 2'), but no measures are disclosed to actually ensure that signatures are not transmitted.

As mentioned above (see point 5.3) and as already stated in the annex to the summons for oral proceedings, keeping something private, i.e. secret, involves more than merely not transmitting such information. Claim 1 as granted encompasses realisations where signatures are transmitted, but are maintained private, for example by transmitting signatures in a secure way. This is no longer required by amended claim 1 according to this request. On the other hand, amended claim 1 encompasses that signatures are not transmitted but are nevertheless made public, which is in contrast to claim 1 as granted.

The board therefore agrees with the opponent's argument that the features replaced by amendment not merely limit the scope of protection of claim 1, but - in contrast to the requirements set out in decision G 1/93 (see headnote 2 of the decision) - have a technical effect and contribute to the limitation of the scope of protection of claim 1. Those features therefore cannot be deleted from claim 1 without extending the scope of protection of claim 1 and thus infringing Article 123(3) EPC.

7.5 Claim 1 according to this request therefore does not fulfil the requirements of Article 123(3) EPC.

Proprietor's auxiliary requests 13 to 16

8. Since claim 1 according to these requests comprises the same feature objected to with regard to auxiliary request 12 (see point 7 above), claim 1 of these requests also does not fulfil the requirements of Article 123(3) EPC.

Proprietor's auxiliary request 17

9. During oral proceedings the proprietor (appellant 1) submitted a further auxiliary request 17 in order to address the issue of Article 123(3) EPC.

9.1 In claim 1 of this request, step ii) of generating a first signature in claim 1 reads "said first correspondent A maintaining said first signature private to itself by avoiding transmission of said first signature". Likewise, step iv) of claim 1 has the corresponding formulation "said second correspondent B maintaining said second signature private to itself by avoiding transmission of said second signature".

9.2 The opponent (appellant 2) objected to this request, that it was late-filed and raised complex new issues, and therefore requested that it should not be admitted into the appeal proceedings.

9.3 The board admitted this request, since it did not introduce new issues, but deals with subject-matter that was already present in the appeal proceedings and had been dealt with in the annex to the summons for oral proceedings (see point 6.2 referring to 6.1 and 5.3).

9.4 While the board agrees with the proprietor (appellant 1) that the amendment overcomes the objection under Article 123(3) EPC, the opponent (appellant 2) is correct that the amended features still give rise to an objection under Article 123(2) EPC.

9.5 For the reasons set out in point 5 above the board agrees with the opponent's argument that the act of keeping something private implies measures to keep the information secret, whereas not transmitting merely avoids such an activity without further measures regarding secrecy.

9.6 The board concurs with the opponent's arguments, in particular that the information alleged to be private is rather the random integer than the signature itself (see original application, page 5, lines 1 to 3). Keeping something private, i.e. secret, involves more than merely not transmitting such information. While there are several passages relating to different protocols directly and unambiguously disclosing that a transmission of the respective signatures SA and SB can be avoided (see point 5.3 above), there is however no direct and unambiguous disclosure for signatures SA and SB to be kept private.

9.7 Therefore the original application documents do not provide a direct and unambiguous disclosure for claim 1, step ii) comprising "said first correspondent A maintaining said first signature private to itself by avoiding transmission of said first signature" and step iv) with the corresponding formulation "said second correspondent B maintaining said second signature private to itself by avoiding transmission of said second signature".

9.8 Claim 1 according to this request therefore does not fulfil the requirements Article 123(2) EPC in contrast to the requirements of Article 100(c) EPC.

10. Hence, none of the proprietor's requests fulfils the requirements of the EPC.