[gjm11]

If CRI really are that much smarter, then in a world without CRI the bad guys would probably never have thought of differential power attacks, in which case it wouldn't matter that they aren't there.

I don't think "maybe CRI would have published even without compensation" is at all the same as "maybe I'd do my job part-time for free". In a world in which CRI couldn't patent anti-DPA measures, I'm betting they'd still be able to get paid plenty well for doing crypto. A fair number of super-smart crypto people are, after all, and they don't all have CRI's patent portfolio. So the analogy is more "maybe I'd publish interesting and useful crypto stuff for free even though it isn't what I'm getting paid for". Which, in fact, you do.

(If you're inclined to object that what you publish for free is not innovative on the scale of the discovery of DPA attacks, let me remind you that you just claimed that CRI are much much smarter than you are.)

For the avoidance of doubt, I am not positively claiming that the world would be better with a patent system in which CRI couldn't have got the patents they have. I don't know whether it would. I just don't think your argument supports your claims very well on this point.