Post-quantum cryptography has one PTAB precedent. What it means for a post-quantum patent portfolio

A company building a patent portfolio around post-quantum cryptography eventually asks the question: when a patent examiner rejects one of these claims, what are the chances of success on appeal? So far, this is untested. Only one decision addresses a quantum-resistant construction on the merits, concerning a lattice scheme. No decision addresses a code-based, hash-based, multivariate or isogeny-based scheme, and none uses the words “post-quantum” or “quantum-resistant” at all.

The application giving rise to that one PTAB decision was not filed as a post-quantum patent per se. IBM’s application, from Craig Gentry and Shai Halevi, claimed key generation for a homomorphic encryption scheme built on ideal lattices: the public key describes a high-dimensional lattice, the secret key is a short vector in it, so breaking the scheme amounts to finding short vectors in that lattice.^[1]

That near-silence is the most useful fact a post-quantum portfolio owner has. There is no Board decision an examiner can cite as a sustained §101 rejection of a quantum-resistant primitive, and the one decision that exists held the construction patent-eligible. The first appeals in this field will be decided on records that have not been written yet, which means the applicants who reach the Board first will shape the doctrine for everyone who follows.

Finding the cases, and the definition problem

The USPTO’s Open Data Portal indexes the full text of every PTAB ex parte appeal decision since 1997. We defined the field by construction: a classical scheme whose security rests on a problem with no known efficient quantum algorithm, in the five families the NIST standardization process recognizes. For each family we searched the vocabulary a Board opinion would actually use. Quantum key distribution and quantum computing hardware were tracked separately and excluded.

The one decision

The single on-point case is Ex parte Gentry and Halevi, Appeal 2017-007680, decided March 27, 2018, on IBM’s application 14/588,505. Claim 1 recites a key-generation method for a somewhat homomorphic encryption scheme: computing the resultant and free term of a scaled inverse of a polynomial modulo x^n ± 1, with n a power of two.^[2] That is the Gentry-Halevi construction over ideal lattices. The decision never uses the words “lattice-based,” “post-quantum” or “learning with errors.” The word “lattices” appears once, inside a passage quoted from the specification, which is why every label-based search missed it.

The examiner in Art Unit 2438 rejected all twenty claims under §101 as “collecting information and using mathematical procedure for converting one form of numerical representation to another.” The Board agreed with that much. At the first step of the Alice test it held the claims directed to an abstract idea. It reversed at the second step. IBM’s brief had pointed to a passage in the specification stating that the claimed key generation avoids a full polynomial inversion, reducing asymptotic complexity from O(n^2.5) to O(n^1.5) when working with dimension-n lattices, and in practice from hours or days to seconds or minutes. The Board found that this transformed the mathematical procedure into “a homomorphic encryption/decryption scheme that improves the underlying encryption and decryption technology.” The application issued as U.S. Patent 10,177,905.

Three features of the decision matter for any post-quantum portfolio. The claim recited the construction by its mathematical structure, not by function; the specification tied the construction to a measurable improvement in the cryptographic operation itself; and the Board treated an efficiency gain in encryption as a technological improvement even after conceding that the claim was directed to mathematics. The decision predates the USPTO’s 2019 eligibility guidance, so under the current framework its reasoning maps onto the “improvement to the functioning of a computer” inquiry rather than onto the inventive-concept step where the Board placed it, but the facts the Board credited are the facts a post-quantum specification can supply.

Two other decisions touch the field without deciding anything in it. In a 2007 appeal (Ex parte Garay, 2007-000930) the specification listed Merkle and Lamport signatures as lightweight options for constrained devices; the appeal turned on whether “fast” and “shorter amount of time” were indefinite. In a 2025 decision (Ex parte Hecusys, 2024-003923) the Board, after affirming a §101 rejection of a homomorphic-encryption claim, recommended in passing that the examiner consider Gentry’s 2009 ideal-lattice paper as prior art. Neither is a ruling on a quantum-resistant construction.

Why the record is so thin

The explanation is mostly timing. An ex parte appeal is decided years after the application is filed: a final rejection, an appeal brief, an examiner’s answer and the Board’s own queue all come first. NIST published the first three post-quantum standards (ML-KEM, ML-DSA and SLH-DSA) in August 2024 and selected HQC as a code-based backup in March 2025. The wave of applications filed around standardization has barely reached final rejection, let alone the Board. The lattice and hash-based applications that could have produced decisions earlier, from the academic groups and large companies filing in the 2010s, were either allowed without appeal or abandoned.

It is also a statement about where the inventions sit. Pure post-quantum constructions tend to be examined in the cryptography art units of Technology Center 2400, where our audit of 818 cryptography appeals found §101 raised in only 17% of decisions and §103 in 89%. Applications there are more often allowed or amended than appealed on eligibility. The appeals that do reach the Board on §101 come disproportionately from Technology Center 3600, where cryptography is plumbing inside a payments or identity workflow and §101 appears in 64% of decisions. Post-quantum migration inventions, hybrid key exchange, crypto-agility tooling and inventory systems, are the ones most likely to land there, and they are also the ones most likely to be filed in volume over the next few years.

What this means for a post-quantum portfolio

For every family

The eligibility record is open, and the one entry is favorable. An examiner rejecting a post-quantum claim under §101 has no Board decision to point to, whatever the family. The applicant has one: a lattice key-generation claim the examiner called a mathematical procedure, which the Board held eligible because the construction improved encryption itself. For a hash-based, code-based or isogeny scheme it is an analogy rather than a precedent on the same construction, but it is the only analogy on the books, and it runs the applicant’s way.

Claim scope should identify the structure underlying the security property. The claim that won recited the polynomial ring, the modulus form and the operations performed on them. Across the wider cryptography record, claims that recite a security property in functional terms (“a proof that reveals nothing,” “a ciphertext indistinguishable from random”) are the ones that lose on written description, and post-quantum terminology is new enough that an indefiniteness challenge is a live risk. Every term of art the claims use, from “module lattice” to “Winternitz chain” to “quasi-cyclic code,” should be defined in the specification with at least one concrete parameter set.

Reasoning from related cryptographic cases remains relevant. With no post-quantum precedent, examiners will reach for the nearest analogies: the “mathematical concept” grouping, and the §101 affirmances of homomorphic-encryption and zero-knowledge claims framed around a financial use. Those affirmances share a pattern, a sequence of transmit-and-verify steps with the cryptographic operation described at functional generality. A post-quantum application that puts the construction, not the workflow, at the center of the independent claim does not fit that pattern, and the response should say so.

Continuation strategy can shape the first appellate record. The first Board decisions on ML-KEM, ML-DSA, SLH-DSA or HQC claims will be cited in every later rejection and response. A portfolio with continuations pending can choose which claim set reaches the Board and on what record. That is a reason to keep a continuation open behind any post-quantum application that draws a §101 rejection, and to appeal the strong claim rather than amend around it. In the USPTO’s quantum docket, every reversal the Board has issued became a patent; there is no reason to expect post-quantum appeals to behave differently.

Migration inventions present a distinct risk profile. Hybrid key exchange, crypto-agility frameworks and cryptographic inventories are where most post-quantum filing volume will be, and they look to an examiner like orchestration rather than cryptography. They will be examined under the workflow patterns the Board has sustained many times, and they need the same discipline the Board rewarded in Gentry-Halevi: a specific technical problem that arose because of computer systems, a specific mechanism, and a specification that explains why the ordered combination is not conventional.

For lattice schemes in particular

Gentry-Halevi provides a direct reference for lattice claims. A lattice applicant is the one party for whom the decision is precedent on the same kind of construction, not an analogy. It should appear in the first response to a §101 rejection, framed as the Board crediting a specific efficiency improvement in a lattice key-generation operation, not as a blanket holding that lattice cryptography is eligible.

Measurable improvements support the technical account. The Board credited a sentence in the specification that compared the claimed construction with the prior approach on a measurable axis: O(n^2.5) against O(n^1.5), hours against minutes. A lattice specification can do the same for key size, ciphertext expansion, sampling cost, decryption-failure rate or constant-time behavior. A specification that says only that the scheme is quantum-resistant gives the Board nothing to hold onto, because the threat model is not an improvement in the claim.

Notes

[1] The lattices Gentry and Halevi used carry extra structure: the secret key is a short generator of a principal ideal in a power-of-two cyclotomic ring. In 2016 Cramer, Ducas, Peikert and Regev, building on a quantum algorithm of Biasse and Song, showed that this structure admits a quantum polynomial-time key-recovery attack on the Smart-Vercauteren variant of Gentry’s scheme, and the Gentry-Halevi key has the same form. So the construction is post-quantum by family and by the assumption it was designed around, not a scheme anyone would deploy for quantum resistance today, and the NIST standards avoid that structure. For the Board’s purposes none of this mattered. The decision is about whether a lattice key-generation method is patent-eligible, and that question is the same for the schemes being filed now.

[2] Claim 1 of U.S. Patent 10,177,905, the claim the Board reviewed in Ex parte Gentry and Halevi, Appeal 2017-007680 (PTAB Mar. 27, 2018), application 14/588,505. Reproduced from columns 61 and 62 of the issued patent.

Source: CipherLaw; based on full-text searches of the USPTO Open Data Portal’s PTAB ex parte appeal decisions (1997 to the present) under a construction-based definition of post-quantum cryptography, the text of every candidate decision, and CipherLaw’s audited corpus of 818 cryptography appeal decisions. Related: Where is post-quantum work heading, and who is driving it? and Where to spend a quantum patent budget.