UNITED STATES PATENT AND TRADEMARK OFFICE
`
`
`
`
`
`
`
`
`
`
`
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`
`
`
`
`
`
`
`
`
`
`
`FACEBOOK, INC., INSTAGRAM, LLC, and WHATSAPP INC.,
`Petitioners
`
`v.
`
`BLACKBERRY LIMITED,
`Patent Owner
`
`
`
`
`
`
`
`
`
`
`
`
`Case IPR2019-00923
`Patent 7,372,961
`
`
`
`
`
`
`
`PATENT OWNER’S PRELIMINARY RESPONSE
`
`
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 001
`
`

`

` 
`
` 
`
` 
`
` 
`
` 
`
` 
`
` 
`
` 
`
` 
`
`TABLE OF CONTENTS
`INTRODUCTION ........................................................................................... 1 
`SUMMARY OF THE ’961 PATENT ............................................................. 2 
`SUMMARY OF THE CITED REFERENCES ............................................... 6 
`  DSS (EX1004) ....................................................................................... 6 
`Rose (EX1006) ...................................................................................... 9 
`  Menezes (EX1005) .............................................................................. 11 
`Schneier (EX1008) .............................................................................. 13 
`Rao (EX1018) / Floyd (EX1019) ........................................................ 13 
`  CLAIM CONSTRUCTION .......................................................................... 14 
`STANDARD FOR GRANTING INTER PARTES REVIEW ....................... 15 
`  GROUND 1 BASED ON DSS IN VIEW OF SCHNEIER AND ROSE IS
`DEFICIENT ................................................................................................... 16 
`The Petition’s Proposed Modification Of DSS In View Of Rose Is
`Flawed And Improperly Rooted In Hindsight .................................... 16 
`1. 
`Rose Fails To Disclose The Missing Claim Features From DSS
` ................................................................................................... 18 
`The Petition Uses The ’961 Claims As A Roadmap To Rewrite
`Rose’s Algorithm Without Justification ................................... 22 
`The Petition Falsely Contends That A Limited Number Of Solutions
`To Mitigating Modulo Bias Would Have Rendered Rose’s Approach
`Obvious To Try, As Evidenced By The Fact That Subsequent
`Versions Of DSS Addressed The Modulo Bias Problem Using
`Multiple Approaches Fundamentally Different From Rose ............... 31 
`  GROUND 2 BASED ON DSS IN VIEW OF SCHNEIER AND MENEZES
`IS DEFICIENT .............................................................................................. 39 
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`2. 
`
`i
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 002
`
`

`

` 
`
` 
`
`  Menezes Does Not Disclose Or Suggest The Claimed Solution, And
`A POSITA Would Not Have Looked To Menezes To Apply In
`Combination With DSS ....................................................................... 40 
`Petitioners Fail To Support Their Modifications In The DSS-Menezes
`Combination, Including The Modification For Repeatedly
`Determining A Random KKEY Value And Hashing The KKEY
`Value .................................................................................................... 45 
`The Petition Falsely Contends That A Limited Number Of Solutions
`To Mitigating Modulo Bias Would Have Rendered Menezes’s
`Approach Obvious To Try, As Evidenced By The Fact That
`Subsequent Versions Of DSS Addressed The Modulo Bias Using
`Multiple Approaches Fundamentally Different From Menezes ......... 52 
`  GROUNDS 3 AND 4 BASED ON COMBINATIONS CITING RAO AND
`FLOYD ARE DEFICIENT ........................................................................... 55 
`  THE BOARD SHOULD EXERCISE ITS DISCRETION UNDER 35
`U.S.C. §314(a) TO DENY INSTITUTION DUE TO THE MATURE
`POSTURE OF THE LITIGATION, IN COMBINATION WITH THE
`PETITION’S KNOWN DEFECTS ............................................................... 56 
`CONCLUSION .............................................................................................. 60 
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
` 
`
`
`
`ii
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 003
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`EXHIBITS
`
`
`
`EX2001
`
`Declaration of Markus Jakobsson, Ph.D.
`
`EX2002
`
`FIPS PUB 186-2, Digital Signature Standard (DSS) Change Notice
`
`(October 5, 2001)
`
`EX2003
`
`FIPS PUB 186-3, Digital Signature Standard (DSS) (June 2009)
`
`Corrected Final Ruling on Claim Construction in BlackBerry Limited
`v. Facebook, Inc. et al (Case No. CV 18-1844-GW) (C.D.Cal.) and
`BlackBerry Limited v. Snap Inc. (Case No. CV 18-2693-GW)
`(C.D.Cal.)
`Serge Vaudenay, Evaluation Report on DSA (2005) (“Vaudenay”)
`
`EX2004
`
`EX2005
`
`
`
`iii
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 004
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`INTRODUCTION
`Petitioners have failed to meet their burden of showing a reasonable
`
`
`
`likelihood that they would prevail with respect to any of the challenged claims of
`
`U.S. Patent No. 7,372,961 (“the ’961 patent”). For the reasons detailed below, the
`
`petition suffers from both factual and legal errors, each of which provides an
`
`independent basis to deny institution. Collectively, the various deficiencies in the
`
`petition, along with the mature posture of concurrent litigation over the ’961 patent
`
`that will reach a final resolution long before any final decision in this forum,
`
`provides overwhelming weight to deny institution of this flawed IPR petition.
`
`As a threshold issue, the Board should exercise its discretion under §314(a)
`
`to deny institution. If instituted here, a PTAB trial would likely conclude in
`
`November 2020—more than a half year after the jury trial will have already
`
`resolved Petitioner’s allegations of invalidity. In this case, a subsequent PTAB
`
`trial would unnecessarily multiply the proceedings, wasting the resources of both
`
`the parties and the Board.
`
`Grounds 1-4 of the petition are also flawed on the merits. Grounds 1 and 3
`
`cite Rose as allegedly providing motivation to modify the Digital Signature
`
`Standard (“DSS”) to address the known security vulnerability associated with
`
`DSS’s key generation algorithm. Yet, Rose itself fails to disclose multiple features
`
`from the solution claimed in the ’961 patent, and the petition improperly attempts
`
`1
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 005
`
`

`

`to cure these deficiencies with modifications to Rose that are unsupported by any
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`evidence submitted with the petition. Likewise, Grounds 2 and 4, which cite
`
`Menezes to address the security vulnerability in DSS, also fails to disclose several
`
`aspects of the ’961 claims for which it is relied upon. In these Grounds, the
`
`petition again resorts to unsupported contentions and hindsight-based reasons to
`
`follow the roadmap gleaned from the ’961 claims. Worse, in arguing that the
`
`claimed solution would have been “obvious to try,” the petition ignores the critical
`
`fact that in three subsequent releases of DSS, none addressed the security
`
`vulnerability in Petitioner’s hindsight matter contrived from Rose or Menezes. The
`
`evidence here confirms the petition’s assertion (that only one or two solutions
`
`existed) was baseless.
`
`For at least these reasons, Patent Owner respectfully requests that the Board
`
`deny institution of Grounds 1-4 of the petition, and decline to institute inter partes
`
`review of the ʼ961 patent.
`
`
`
`SUMMARY OF THE ’961 PATENT
`The ’961 patent discloses a novel solution for generating a cryptographic
`
`key k in an unbiased manner so as to improve the security of a cryptographic
`
`function where the key k is applied. EX1001, 2:65-3:4, 3:64-4:17, FIG. 2;
`
`EX2001, ¶¶17-20; see also id., ¶¶15-16.
`
`As the background of the ’961 patent explains, certain cryptographic
`
`2
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 006
`
`

`

`functions such as the Digital Signature Algorithm (DSA) “utilize both long term
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`and ephemeral keys to generate a signature of [a] message.” Id., 1:54-56. A party
`
`that digitally signs a message uses a new ephemeral key k on a per-message or per-
`
`session basis in order to obscure the party’s permanent or long-term private key.
`
`Id., 1:33-51.
`
`Ideally, the key k is chosen uniformly at random from a pre-defined range of
`
`values (possibly subject to known security requirements). However, certain
`
`implementations of the DSA—including the Digital Signature Standard (DSS) that
`
`was promulgated by the National Institute of Standards and Technology (NIST) in
`
`the FIPS 186-2 standard—“inadvertently introduce a bias in to the selection of k.”
`
`Id., 2:3-34. This bias made the selection of some values for the key k within the
`
`acceptable range more likely than others. Id. According to the ’961 patent, the
`
`bias could be “exploited to extract a value of the [user’s long-term] private key d
`
`and thereafter render the security of the system vulnerable.” Id., 2:33-36. For
`
`example, researcher Daniel Bleichenbacher determined that the method specified
`
`in DSS for generating the ephemeral key k introduced sufficient bias such that an
`
`examination of 222 signatures could allow a hacker to derive a user’s long-term
`
`private key, thereby enabling the hacker to sign messages as if he or she were the
`
`authorized user.. Id., 2:56-61.
`
`Despite Bleichenbacher’s recognition of a security vulnerability stemming
`
`3
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 007
`
`

`

`from DSS’s biased selection of ephemeral key k, a workable solution to the
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`problem had not yet been resolved before the effective filing date of the ’961
`
`patent (December 27, 2000). On this date, the inventors of the ’961 patent filed a
`
`patent application disclosing their solution for addressing the security vulnerability
`
`identified by Bleichenbacher. Simply put, the reality in December 2000 was far
`
`different from Petitioner’s current hindsight-based theory of what a person of
`
`ordinary skill in the art (“POSITA”) would have been prompted to do.
`
`The inventors’ techniques involved determining a key k by first generating a
`
`seed value from a random number generator, hashing the seed value using a
`
`suitable hash function (e.g., SHA), and comparing the output of the hash function
`
`to a parameter related to how the key k is to be employed (e.g., q in DSS). Id.,
`
`3:64-4:17, FIG. 2. Specifically, the length L of the output of the hash function in
`
`terms of a number of binary bits may be at least as long as the length of the
`
`parameter q against which the hash output is compared. As such, the output of the
`
`hash function will sometimes exceed the value of q and fall outside the acceptable
`
`range of values for the key k (e.g., since k must be less than q in DSS). EX2001,
`
`¶20. The inventors proposed to ensure the selection of a compliant key k without
`
`introducing bias by either accepting the hashed seed value as the key k if the
`
`hashed value were less than the compared parameter (e.g., q), and rejecting the
`
`hashed value as the key k if the hashed value were greater than or equal to that
`
`4
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 008
`
`

`

`parameter. EX1001, 3:64-4:17, FIG. 2 (reproduced below). If a hashed value was
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`rejected for being too large, the method would repeat until an acceptable hash
`
`value was found that could be used as the key k. Id. This approach stands in
`
`contrast, for example, to DSS’s method of generating key k where a modulo
`
`reduction was performed on the output of a hash function—thereby introducing the
`
`bias that Bleichenbacher was able to leverage to compromise the long-term private
`
`key of a user. See EX1004, p. 18; infra, Section III.A.
`
`EX1001, FIG. 2.
`
`
`
`5
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 009
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
` SUMMARY OF THE CITED REFERENCES
` DSS (EX1004)
`The DSS reference submitted in this proceeding is a copy of the FIPS 186-1
`
`Digital Signature Standard document.1 See EX1004; EX2001, ¶¶24-28. As
`
`explained in the reference, DSS “specifies a Digital Signature Algorithm (DSA)
`
`appropriate for applications requiring a digital, rather than written, signature.” Id.,
`
`5. “The digital signature is computed using a set of rules (i.e., the DSA) and a set
`
`of parameters such that the identity of the signatory and integrity of the data can be
`
`verified.” Id. Figure 1 shows an overview of digital signature generation and
`
`verification in DSS:
`
`
`1 Petitioners contend that the version of DSS submitted with the petition (i.e., FIPS
`
`186-1 (1994) (EX1004)) prescribes the same key generation method as the version
`
`of the standard (i.e., FIPS 186-2) referenced in the background of the ’961 patent.
`
`Pet., 20.
`
`6
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 010
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`
`
`EX1004, FIG. 1.
`
`The signature generation algorithm specified in DSS uses both a long-term
`
`private key x of the signer and a short-term (ephemeral) key k to generate a digital
`
`signature for a message. Id., 10-11, 17-18. Of particular relevance to the instant
`
`proceeding, DSS describes an algorithm for pre-computing a batch of ephemeral
`
`keys k:
`
`7
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 011
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`EX1004, 182; see also 17 (describing that the function G(t,KKEY) is a one-way
`
`function such as the Secure Hash Algorithm (SHA) or Data Encryption Standard
`
`
`
`(DES)).
`
`This key generation algorithm from DSS is referenced in the background
`
`section of the ’961 patent, which notes that (according to Step 3(a) above), “DSS
`
`requires the reduction of the integer mod q, i.e., k=SHA(seed) mod q” and this
`
`
`2 For purposes of clarity, the image of text as it appears in the publication is shown;
`
`the words are included in total word count below as if they were presented as a
`
`block quotation of text.
`
`8
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 012
`
`

`

`operation introduces bias into the selection of key k. EX1001, 2:41-61.
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`Notably, DSS’s algorithms allow for computation of a batch of keys k
`
`without randomly selecting a new seed-key (KKEY) each time a new key k is to be
`
`computed. EX1004, 18; EX2001, ¶28. The seed-key (KKEY) is independently
`
`selected (e.g., using a random number generator) only once—namely, when the
`
`algorithm commences to allow for computation of the initial key k in the batch.
`
`See EX1004, 18 (“Step 1. Choose a secret initial value for the seed-key, KKEY.”);
`
`EX1001, 2:40-42 (“A seed value, SV, is generated from a random number
`
`generator which is then hashed by a SHA−1 hash function …”). After the
`
`algorithm computes the initial key k in the batch, subsequent keys k are computed
`
`simply by updating the value of the seed-key (KKEY) according to the formula set
`
`forth in Step 3(d): KKEY = (1 + KKEY + k) mod 2b. EX1004, 14. DSS thus
`
`acknowledges that it is unnecessary to randomly re-select KKEY for each iteration,
`
`and expressly discloses a preference for applying a deterministic function to update
`
`KKEY based on its prior value rather than performing an independent, randomized
`
`re-selection of KKEY. EX2001, ¶28.
`
` Rose (EX1006)
`The Rose reference is an alleged newsgroup posting that describes a method
`
`for “roll[ing] a random number in the interval [0, n).” EX1006, 2; EX2001, ¶¶29-
`
`30. In particular, Rose’s suggested method is explicitly defined by the following
`
`9
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 013
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`computer code:
`
`
`
`EX1006, 23.
`
`As shown in the computer code, Rose’s method determines a random
`
`number within a specified range [0, n-1] by first computing the largest multiple of
`
`n that is less than or equal to BIG (i.e., “the biggest value returned by random ()”)
`
`and assigns this value to the variable ‘biggest.’ EX1006, 2. The method then
`
`enters a do-while loop that repeatedly determines a random number using the
`
`random() function until the output of the random() function is less than the value of
`
`‘biggest’ (i.e., until the output of the random() function is less than the largest
`
`computed multiple of n). Id. Because the final output of the random() function
`
`
`3 Supra, footnote 2.
`
`10
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 014
`
`

`

`(assigned to the variable ‘rval’) upon exiting the loop is compared to a multiple of
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`n and thus may be greater than the maximum value of the specified range (n-1),
`
`Rose’s method ends by computing ‘rval’ modulo n and returns the result of this
`
`operation as the output of the software routine. Id.
`
`While Rose purports to “[a]void [a] slight bias to low numbers” for the basic
`
`task of random number generation, Rose never explains how its techniques could
`
`be applied to a key generation algorithm, never seeks to avoid bias in a value other
`
`than the output of a random number generator (e.g., never seeks to avoid bias in a
`
`hash of the output of the random number generator within a desired range that is
`
`smaller than the range of the hash function itself), and never repeats the pair of
`
`operations required by the ’961 claims when the result of a particular iteration is
`
`rejected. EX2001, ¶30. Rose thus provides a meaningfully different solution to a
`
`different problem than that addressed by the ’961 patent. Id.
`
` Menezes (EX1005)
`Menezes is textbook on the subject of “applied cryptography” that spans
`
`hundreds of pages, but the petition relies almost exclusively on a single paragraph
`
`of disclosure regarding random number generation:
`
`11
`
`
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 015
`
`

`

`EX1005, 694; EX2001, ¶¶31-33.
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`Unlike Rose, Menezes does not explicitly offer source code for the
`
`algorithm disclosed in the cited paragraph. Nonetheless, Menezes’s algorithm
`
`shares with Rose many of the same points of departure from the features recited in
`
`the Challenged Claims of the ’961 patent. EX2001, ¶33. For example, as
`
`explained in further detail below (Section VII), Menezes’s algorithm determines
`
`whether to accept or reject an integer of a bit sequence output by a random bit
`
`generator rather than operating on the hash of a randomly generated number.
`
`These different contexts are material because Menezes assumes the availability of
`
`a perfect random bit generator that could generate each bit in a sequence without
`
`any bias. EX2001, ¶33. But a POSITA would have recognized that such a bit
`
`generator that exhibited perfect randomness is largely theoretical and unavailable
`
`for broad adoption on a wide range of systems (such as the range of systems that
`
`typically implemented DSS). By starting with a perfect random bit generator,
`
`Menezes had no need to perform additional transformations on the random integer
`
`produced by the bit generator. In reality, however, Menezes’ approach is
`
`impractical, and so the ’961 patent provides a fundamentally different solution for
`
`
`4 Supra, footnote 2.
`
`12
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 016
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`generating an unbiased output within a desired range by first obtaining a seed value
`
`from a random number generator, and then hashing the seed value—thereby
`
`removing or obscuring any bias that is often present in real-world random number
`
`generators. EX2001, ¶33.
`
`These, and other deficiencies, highlight the flaws in Petitioner’s hindsight-
`
`based proposals that fall short of the innovation described in the ’961 patent.
`
`
`Schneier (EX1008)
`Schneier is another textbook on the subject of applied cryptography covering
`
`a wide range of topics. See EX1008; EX2001, ¶34. The petition cites Schneier for
`
`its discussion of “various techniques for generating random and pseudorandom
`
`numbers” and its alleged description of the “benefit of [true random numbers] over
`
`pseudorandom numbers in cryptographic key generation.” Pet., 27 (citing
`
`EX1008, 146-153).
`
` Rao (EX1018) / Floyd (EX1019)
`The petition relies on Rao and Floyd for their alleged descriptions of
`
`“arithmetic processor[s]” and “arithmetic/logic unit[s] (ALU[s]),” respectively.
`
`Pet., 60-62. The arguments presented in this Preliminary Response are not
`
`specifically directed to the citations of Rao and Floyd, but Patent Owner reserves
`
`its right to raise additional arguments in this regard at appropriate times in this
`
`proceeding in the future.
`
`13
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 017
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
` CLAIM CONSTRUCTION
`Patent Owner submits that all claim terms should be construed according to
`
`the Phillips standard. Phillips v. AWH Corp., 415 F.3d 1303 (Fed. Cir. 2005); 37
`
`C.F.R. §42.100; EX2001, ¶¶15-16 (level of ordinary skill for a “POSITA”).
`
`Unlike the broadest reasonable interpretation standard, the Phillips standard seeks
`
`“the correct construction—the construction that most accurately delineates the
`
`scope of the claim[ed] invention.” PPC Broadband, Inc. v. Corning Optical
`
`Comm’ns RF, LLC, 815 F.3d 734, 740-42 (Fed. Cir. 2016). Under the Phillips
`
`standard, the purpose of claim construction is “to understand and explain, but not
`
`to change, the scope of the claims.” Embrex, Inc. v. Serv. Eng’g Corp., 216 F.3d
`
`1343, 1347 (Fed. Cir. 2000).
`
`On April 5, 2019, the district court issued a claim construction order in the
`
`concurrent litigation, and a copy of the order is provided here. See EX2004.
`
`Regarding the claim phrase “reducing mod q,” the district court concluded that
`
`this phrase means “computing the remainder of dividing a value by q.” EX2004,
`
`31-35. The district court cited to column 2:32-55 of the ’961 patent as being
`
`consistent with this construction. Id., 34. Here, Grounds 1-4 are fatally defective
`
`for the reasons detailed below regardless of whether the district court’s formal
`
`constructions for the terms of the ’961 patent are adopted. Thus, Patent Owner
`
`recognizes the Board may determine that no formal claim constructions are
`
`14
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 018
`
`

`

`necessary at institution because “claim terms need only be construed to the extent
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`necessary to resolve the controversy.” Wellman, Inc. v. Eastman Chem. Co., 642
`
`F.3d 1355, 1361 (Fed. Cir. 2011); EX2001, ¶¶21-23.
`
`
`
`STANDARD FOR GRANTING INTER PARTES REVIEW
`The Board may grant a petition for inter partes review only where “the
`
`information presented in the petition … shows that there is a reasonable likelihood
`
`that the Petitioners would prevail with respect to at least 1 of the claims challenged
`
`in the petition.” 35 U.S.C. §314(a); 37 C.F.R. §42.108(c). Petitioners bear the
`
`burden of showing that this statutory threshold has been met. See Office Patent
`
`Trial Practice Guide, 77 Fed. Reg. 48,756, 48,756 (Aug. 14, 2012). Critically,
`
`Petitioners must fulfill this burden based on “information presented in the petition”
`
`(35 U.S.C. §314(a)), and the law forbids Petitioners from subsequently adding
`
`theories/arguments that should have been part of their initial petition. Intelligent
`
`Bio-Systems, Inc. v. Illumina Cambridge, Ltd., 821 F.3d 1359, 1369 (Fed. Cir.
`
`2016) (citing to 35 U.S.C. § 312) (“It is of the utmost importance that petitioners in
`
`the IPR proceedings adhere to the requirement that the initial petition identify
`
`‘with particularity’ the ‘evidence that supports the grounds for the challenge to
`
`each claim.’”); see also Cuozzo Speed Techs., LLC v. Lee, 136 S.Ct. 2131, 2154
`
`(2016) (Alito, J. concurring in part and dissenting in part) (“Thus, if a petition fails
`
`to state its challenge with particularity—or if the Patent Office institutes review on
`
`15
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 019
`
`

`

`claims or grounds not raised in the petition—the patent owner is forced to shoot
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`into the dark. The potential for unfairness is obvious.”).
`
`As such, the original petition must establish a prima facie case of
`
`obviousness with regard to its proposed combinations of references. It is well
`
`settled that “rejections on obviousness cannot be sustained by mere conclusory
`
`statements; instead, there must be some articulated reasoning with some rational
`
`underpinning to support the legal conclusion of obviousness.” KSR Intn’l Co. v.
`
`Teleflex Inc., 550 U.S. 398, 418 (2007) (quoting In re Kahn, 441 F.3d 977, 988
`
`(Fed. Cir. 2006)); PersonalWeb Techs., LLC v. Apple, Inc., 848 F.3d 987, 993
`
`(Fed. Cir. 2017) (explaining that it is insufficient to allege “that a skilled artisan,
`
`once presented with the two references, would have understood that they could be
`
`combined.”). As shown below, Petitioners have not established a prima facie case
`
`of obviousness with respect to Grounds 1-4, and the Board should decline to
`
`institute review of the ’961 patent.
`
` GROUND 1 BASED ON DSS IN VIEW OF SCHNEIER AND ROSE IS
`DEFICIENT
` The Petition’s Proposed Modification Of DSS In View Of Rose Is
`Flawed And Improperly Rooted In Hindsight
`The combination cited in Ground 1 starts with the digital signature algorithm
`
`disclosed in DSS and alleges that it would have been obvious for a POSITA to
`
`16
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 020
`
`

`

`modify DSS based on Rose to arrive at the inventions claimed in the ’961 patent.5
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`But as explained in detail below, Petitioners’ contentions here are false and
`
`unsupported by the evidence. EX2001, ¶¶39-54. DSS merely discloses the same
`
`key generation technique that was already referenced in the background of the ’961
`
`patent, which suffers from a bias that renders its signature scheme subject to
`
`compromise. EX1004, 17-18; EX1001, 1:52-2:61. Rose then discloses an
`
`algorithm for generating a random number within a specified range, but the
`
`algorithm differs in multiple respects from the features that are actually recited in
`
`the Challenged Claims. EX1006. Despite these differences, the petition proceeds
`
`
`5 The petition relies on Schneier for its teaching of a true random number generator
`
`to the extent that such a generator is not expressly disclosed in DSS. Pet., 42.
`
`However, this brief focuses on the flaws in Rose (Grounds 1 and 3) and Menezes
`
`(Grounds 2 and 4), as well as the flaws in the petition’s modification of DSS in
`
`view of Rose or Menezes, respectively. For simplicity, Patent Owner at times
`
`refers to the DSS-Rose or DSS-Menezes combinations and modifications to DSS
`
`in view of Rose or Menezes without explicit reference to Schneier. Nonetheless, it
`
`is recognized that Schneier is also part of these Grounds, and Patent Owner will
`
`address the deficiencies of Schneier later (if necessary) in this proceeding.
`
`17
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 021
`
`

`

`to argue that the proposed combination of DSS and Rose somehow would have
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`provided all the features of independent claim 1. But Petitioners offer no evidence
`
`or explanation to justify material changes that were required to be made to Rose’s
`
`algorithm to allegedly map the DSS-Rose combination to claim 1. Lacking such
`
`evidence or other corroboration, Petitioners’ DSS-Rose combination in Ground 1 is
`
`improperly rooted in hindsight and is critically flawed.
`
`1.
`
`Rose Fails To Disclose The Missing Claim Features From
`DSS
`DSS discloses the same, insecure algorithm that introduces bias in the
`
`selection of key k as described in the background of the ’961 patent. EX2001, ¶40.
`
`As such, the petition relies exclusively on Rose to argue that the inventors’ claimed
`
`solution to the bias problem would have been obvious. Pet., 42 (FN 11). In these
`
`circumstances, it might be expected that Rose would disclose the limitations of
`
`claim 1 that are missing from DSS. But this is not the case. Rose instead describes
`
`a random number generator that never would have been acceptable for use in a
`
`cryptographic function such as DSS. EX2001, ¶¶41-42. Worse, Rose actually
`
`fails to disclose several of the limitations that are also missing from DSS. Id.
`
`For context, recall that Rose discloses the following software code to
`
`illustrate his algorithm for rolling a random number in the range [0, n-1]:
`
`18
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 022
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`
`
`EX1006, p. 2 (highlighting and annotations added)6.
`
`Even a cursory review of Rose’s code reveals three critical differences from
`
`the techniques described and claimed in the ’961 patent. First, Rose merely
`
`updates ‘rval’ in each iteration of the do-while loop by calling the random()
`
`function and assigning its output to ‘rval’. In contrast, claim 1, which recites the
`
`following operations, requires more:
`
`generating a seed value SV from a random number
`generator;
`performing a hash function H( ) on said seed value
`
`
`6 Supra, footnote 2.
`
`19
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 023
`
`

`

`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`SV to provide an output H(SV);
`determining whether said output H(SV) is less than
`said order q prior to reducing mod q;
`accepting said output H(SV) for use as said key k if
`the value of said output H(SV) is less than said order q;
`rejecting said output H(SV) as said key if said value is
`not less than said order q;
`if said output H(SV) is rejected, repeating said
`method;
`
`EX1001, 5:37-48 (claim 1) (emphasis added).7 Thus, claim 1 provides for the
`
`method to be repeated after each rejection, and that the repeated method includes
`
`“performing a hash function H( ) on said seed value SV to provide an output
`
`H(SV).” Yet, Rose’s loop only evaluates the random() function to generate an
`
`output ‘rval’ (allegedly corresponding to the “seed value SV” of claim 1). Rose
`
`never performs the additional operation required by claim 1 of performing a hash
`
`function on the seed value (e.g., performing a hash function on ‘rval’) either in the
`
`loop or before the loop is entered. EX2001, ¶¶41-42 (explaining that the
`
`
`7 Independent claim 15 recites corresponding language to claim 1, and the
`
`petition’s challenges against claim 15 are deficient for at least each of the same
`
`reasons that are explained herein with respect to claim 1.
`
`20
`
`MOBILEIRON, INC. - EXHIBIT 1029
`Page 024
`
`

`

`“random()” function represented in Rose invoked a common random number
`
`Proceeding No. IPR2019-00923
`Attorney Docket No: 21828-0046IP1
`
`
`generator based on a physical source of randomness rather than a hash or other
`
`one-way function).
`
`A second difference stems from the condition that Rose employs to exit the
`
`do-while loop. Claim 1 recites that the output H(SV) is accepted if its value is less
`
`than “said order q” and rejected if its value is not less than “said order q.”
`
`EX1001, 5:37-48. That is, acceptance or rejection of the output H(SV) turns on
`
`whether its value is less than the parameter q. The petition (pp. 37-39) alleges
`
`correspondence between ‘n’ (Rose) and ‘q’ (’961 claims), but even under
`
`Petitioners’ mapping, Rose does not condition its acceptance or rejection of ‘rval’
`
`in an analogous manner to the ’961 patent. Specifically—as Petitioners’ own
`
`declarant, Dr. Katz, admits—Rose compares ‘rval’ not to ‘n’ itself but instead to
`
`the value ‘biggest’, where ‘biggest’ is a multiple of ‘n’ (and potentially much
`
`greater than ‘n’ itself). Pet. 37 (“biggest is assigned to the largest multiple of ‘n’
`
`that is less than or equal to BIG”) (citing EX1002, ¶132).
`
`Third, further Rose departs from the ’961 claims as a result of the modulo
`
`operation perfo