Info-PGP: PGP Digest Wednesday 16 December 1992 Volume 2 : Number 5 Hugh Miller, List Manager / Moderator Info-PGP is a digested mailing list dedicated to discussion of Philip Zimmermann's `Pretty Good Privacy' (PGP) public-key encryption program for MS-DOS, Unix, VMS, Atari, Amiga, SPARC, Macintosh, and (hopefully) other operating systems. It is primarily intended for users on Internet sites without access to the `alt.security.pgp' newsgroup. Most submissions to alt.security.pgp will be saved to Info-PGP, as well as occasional relevant articles from sci.crypt or other newsgroups. Info-PGP will also contain mailings directed to the list address. To SUBSCRIBE to Info-PGP, please send a (polite) note to info-pgp-request@lucpul.it.luc.edu. This is not a mailserver; there is a human being on the other end, and bodiless messages with "Subject:" lines reading "SUBSCRIBE INFO-PGP" will be ignored until the sender develops manners. To SUBMIT material for posting to Info-PGP, please mail to info-pgp@lucpul.it.luc.edu. In both cases, PLEASE include your name and Internet "From:" address. Submissions will be posted pretty well as received, although the list maintainer / moderator reserves the right to omit redundant messages, trim bloated headers & .sigs, and other such minor piffle. I will not be able to acknowledge submissions, nor, I regret, will I be able to pass posts on to alt.security.pgp for those whose sites lack access. Due to U.S. export restrictions on cryptographic software, I regret that I cannot include postings containing actual source code (or compiled binaries) of same. For the time being at least I am including patches under the same ukase. I regret having to do this, but the law, howbeit unjust, is the law. If a European reader would like to handle that end of things, perhaps run a "Info-PGP-Code" digest or somesuch, maybe this little problem could be worked around. I have received a promise of some space on an anonymous-ftp'able Internet site for back issues of Info-PGP Digest. Full details as soon as they firm up. Oh, yes: ALL CONTRIBUTIONS CONSIDERED AS PERSONAL COMMENTS; STANDARD DISCLAIMERS APPLY. Hugh Miller | Asst. Prof. of Philosophy | Loyola University Chicago FAX: 312-508-2292 | Voice: 312-508-2727 | hmiller@lucpul.it.luc.edu Signed PGP v.2.1 public key certificate available by e-mail & finger(1) =-=-=-=-=-= Newsgroups: sci.crypt,alt.security.pgp From: strnlght@netcom.com (David Sternlight) Subject: Re: PKP/RSA comments on PGP legality Date: Tue, 15 Dec 1992 11:08:14 GMT Hugh Miller's article is filled with so many inaccuracies it's hard to know where to start, so I'll treat only a few; the remainder is left to others as it's pretty late at night. I'm going to digest, since the message is so long. The first part consists of a massive imputation of motives to Jim Bidzos simply because he gave Carl Ellison some information. As it happens, he gave the same information to me and others. Miller's analysis reads like a paranoid piece of thinking to me. He next finds the advocacy of ripem (which is legal) rather than PGP (which is not, in the U.S.) sinister. More paranoia? He then decides to interpret Bidzos' comments as "threats" instead of statements of fact about Bidzos' interpretation of the PKP patents and the Munitions Act. I must tell Miller, who appears to be winging it without checking the Act, that Bidzos message to me contained extensive quotations from the Munitions act which make it absolutely clear to me that Bidzos is accurate and so is Ellison's summary. Miller then enlightens us on what lawyers do. Is Miller an attorney, or is this more imputation of motives for something Miller doesn't like? Next Miller reports on RSA's income and number of licenses. Is Miller making this up, too, or has he some hard data. According to what Bidzos tells me there are a large number of licenses out there, including Lotus Notes and several other major applications, future IBM and Apple software, etc. Then Miller characterizes as "intimidation and innuendo" what I would characterize as "fair warning." He leaps from Bidzos mentioning that PKP in the U.S. is an ITAR violation (Bidzos provided detailed Munitions Act quotes in his message to me which convinces me he's right), to Bidzos prosecuting developers under the ITAR. That's a totally false statement. Miller then decides to use this as a way to vamp to his obvious dislike of the Reagan Administration. Has no one told Miller that Bush is President, and soon Clinton. Next we have a superb analysis of why the government won't prosecute anyway (because they're embarrassed by a few other incidents) which simply takes the breath away, and is likely to go down in legal annals. I'd hate to be a D.A. taking instructions from Miller. Miller then moves to an attempt to argue that one may, with impunity, post export-prohibited materials to a bulletin board which foreigners have access to. His arguments at this point have become pathetic in his eagerness to make himself right and RSA wrong. He'd better talk to a few software companies which sell export controlled materials, to see what safeguards are, in fact required. Then follows some more bad-mouthing of Bidzos. This is followed by contradictory statements (and wrong ones) about RSAREF. First we hear that he's never seen any RSAREF compiled object code. A few sentences later we read that it's compiled into the ripem beta. Then we hear that the ripem beta isn't available on many platforms (false). Well, there's lots more but I've run out of steam. Apologies for the length of this, which matches paragraph for paragraph with Miller's post--to include that post would have made this message unconscionably longer. Finally, I'm appalled that someone with the logical and factual deficiencies represented in Miller's message is the moderator of the PGP list. I can well imagine what goes on there. David =-=-=-=-=-= Newsgroups: alt.security.pgp From: hmiller@lucpul.it.luc.edu (Hugh Miller) Subject: PAX - Public Access Unix - Anonymous Posting Service Date: Tue, 15 Dec 1992 08:39:53 GMT Here's the file you can get by sending an empty message to anon.info@pax.tpa.com.au. PAX - Public Access Unix (Adelaide,South Australia) - Anonymous Posting Host ============================================================================ Last modified: Fri Nov 20 18:55:52 CST 1992 Information about Anonymous & Privacy-Enhanced Posting. ======================================================= PAX is conducting research into the viability of anonymous privacy- enhanced mail as a means of providing practical, secure and confidential electronic mail and news. An experimental server has been setup and you are encouraged to use it. There are many anonymous posting services in existence which provide anonymous electronic mail and posting to specific newsgroups where posting is sometimes harmful to one's health or reputation ! Such services allow you to: - post anonymously to those news groups - reply anonymously to posts by email - converse anonymously with another anonymous user, neither of you knowing your real identities Privacy-enhanced electronic mail refers to the concept of encrypting one's mail prior to sending it off into the ether, presumably to someone at the other end capable of decrypting it. If one uses a so-called "public key" method of encryption, then one can make one's "public" key widely known so that anyone can encrypt mail to you, but only you can decrypt it using your "secret" key. There is much development going on in this area, but one quite popular public-domain implementation is Philip Zimmermann's "Pretty Good Privacy 2.0" which makes use of a number of cryptographic methods including the RSA algorithm in places (See Legal Issues later on). PGP allows you to: - exchange public keys with another individual - encode messages to them that only they can read - receive messages from them that only you can read These tools are all very well for the specific purposes for which they were designed, but unfortunately your anonymous message or post is not actually anonymous until it gets to the machine that host's the service. Anyone in between, including your own administrators, can in theory read your post, even though they won't know to whom it is directed. What is more they can also read replies addressed back to you. This can be highly embarrassing at best, and result in dismissal or disconnection at worst if your thoughts, beliefs or activities are disapproved of by the powers that be, even if they are perfectly legal. PAX's privacy-enhanced anonymous services were conceived in the belief that free speech and privacy are fundamental rights and that it is high time the networks to which we are connected provided such services on a routine basis. Seeing as they don't we have to make a start somewhere. This service provides: - conventional anonymous mailing and posting services via a "normal" alias assigned in the usual fashion - the ability to post to ANY newsgroup that is carried out of PAX (which includes most non-regional groups) - PGP 2.0 based privacy-enhanced mail & posting, including: - ability to register your "public" key with PAX, so that PAX can send encrypted messages to you - local generation of a unique public key which is sent to you, so that you can send encrypted messages to PAX - any encoded messages from you mailed to a user or newsgroup are decrypted at PAX before being passed on in anonymous form - any anonymous replies to your "pgp" alias are encrypted before being mailed to you For example, once you have obtained your PGP 2.0 software (as described later) and got it going, and once you have generated and registered your public key and received PAX's key in response, you will be able to post to any newsgroup without anyone beyond your machine having access to the plaintext of your post. Furthermore, if another user has registered in the same manner, and you know their anonymous alias or are responding to one of their anonymous posts, even though you don't know who they are and haven't exchanged keys to communicate directly, the PAX service will automatically decrypt any encrypted messages from you and re-encrypt them before passing them on to the other person ! How to use it. ============== All transactions are handled by email, and commands are selected by the name of the alias to which you mail, not by the subject or body of the message (which are ignored unless sending or posting a message). The separator between the "anon" and the command is a dot (period,'.') and nothing else will work ! Not '-', not '_', not ":", only a dot. The site to address mail is "pax.tpa.com.au". If this fails for some reason, you may need to address it to the specific host (at present) ie. "flash.pax.tpa.com.au". "Normal" (unencrypted) commands: - To get information (this message): mail anon.info@pax.tpa.com.au - To see what your "normal" alias is, or get one: mail anon.ping@pax.tpa.com.au - To send a reply to another anonymous user: mail anon.###@pax.tpa.com.au NB: - eg. mail anon.36@pax.tpa.com.au - don't be creative ... anon.036 won't work - an attempt is made to strip off signature lines by discarding everything after a line starting with "--" or "__" - To send a post to a newsgroup: mail anon.post.groupname@pax.tpa.com.au NB: - eg. "mail anon.post.talk.abortion" will send a post to "talk.abortion" - only the Subject field from your post is used, the rest of the header is discarded - the newsgroup is selected by the alias; Newsgroup header fields are discarded; hence cross-posting isn't feasible - signatures are stripped as above "PGP" (encryption) commands: - To register your public key with PAX: (ABSOLUTELY NECESSARY) mail anon.key@pax.tpa.com.au NB: - first you have to make install pgp and make a key then send it in a "anon.key" command - the body of the message MUST contain an ascii encoded public key generated by PGP V2.0. You may use your regular public key that you give to other people if you wish. The user ID name must be unlikely to conflict with one PAX already has, so use your full name, or include your email address or something. If you want you can use a unique key just for PAX - it makes no difference. If PAX already has a key of the same user-id it will reject yours. Note that this means that you need different key user-id's on different machines (or mail addresses anyway). # makes new keys & adds to your "keyring" pgp -kg Enter a user ID for your public key: First M. Last of somefirm # extract key in ascii form suitable for a message body pgp -kxa "First M. Last of somefirm" savedfile pubring # send it to PAX mail anon.key@pax.tpa.com.au Subject: pgp21 available in Baltics Date: Mon, 14 Dec 1992 10:09:08 +0300 Hi! Now both pgp21.zip (executables, docs) and pgp21src.zip (sources) are available for FIDO file requests (FREQ) from PGP Supporting Sites in Latvia Info-Shelter 2:495/28 and Castle 2:495/21. PGP21.ZIP 187758 Pretty Good Privacy 2.1 Execs and Docs PGP21SRC.ZIP 436302 Pretty Good Privacy 2.1 Sources Since there is great interest in new PGP 2.1, please use fast modems if possible (16800 baud preferable :-) But, seriously speaking, nobody will be rejected. According to our experience, calls from non-xUSSR countries are much easier in night time. I would like to ask people who make PGP 2.1 varieties for different hardware platforms (McIntosh, Amiga,...) and different languages (Language Kits) to upload them directly to 2:495/28 or send as signed PGP-ed ASCII messages to Harry@castle.riga.lv. Please don't forget to sign the kit. Best wishes, Harry Monday December 14 1992 04:17 --- Golded 2.40.P0720+ via D'Bridge 1.50 * Origin: Harry Bush, Harry@castle.riga.lv (2:495/28) =-=-=-=-=-= Newsgroups: sci.crypt,alt.security.pgp From: res@colnet.cmhnet.org (Rob Stampfli) Subject: Re: PKP/RSA comments on PGP legality Date: Tue, 15 Dec 1992 05:31:35 GMT In article <1992Dec14.014118.11612@netcom.com> strnlght@netcom.com (David Sternlight) writes: > >Bill Stewart corrects my understanding of PGP and IDEA (thanks), which >suggests that troubles for possession and/or use of PGP2.x in the U.S. >can also come from the Munitions Act since PGP is based on an import >of the IDEA implementation, rather than domestic coding of the IDEA >algorithm. > >If my understanding is now accurate that PGP2.x violates both the >Munitions Act and PKP's patents, and that this violation is occasioned >not just by use but also by possession in the U.S., then it would seem >prudent to get it off one's U.S. computers and any U.S. net >sites--Internet, Usenet, Fidonet, anynet. Presence on a bulletin board >system may be just what someone needs to close down that system. I am still not convinced, from what I have read in this forum, that the mere possession of PGP is prima facia evidence that one has personally violated the Muntions Act. The code has been readily available on a number of local (internal to US) machines. There are many things that may not be individually imported (at least very easily), but which are legal to possess in this country. I do agree with you that by making the program available indiscriminately, you may potentially become liable for violation of the (in my mind neanderthal) export provisions of the Munitions Act. >For completeness and to acknowledge a particular position (with which >I disagree), some feel that it's absurd to prevent use of something >here that's widespread in Europe, and are willing to take a chance in >order to press that. I do not understand what you disagree with. Do you disagree with those who feel that crypto software that is available to the rest of the world should be available to Americans, or do you disagree with the taking of chances to potentially arrive at those ends? >My own position is >that if one thinks a law or situation is incorrect, one moves to get >it changed, if possible. One does not take the law into one's own >hands. Actually, as I understand the legal system in the US, there are two avenues by which law may be changed. You can petition for legislative action, or you can take your case into the courts. Now, courts generally don't rule on speculative issues -- they usually demand a bona fide case on which to judge. Hence, you very much have to take the law into your own hands -- someone has to become the proverbial guinea pig. This is exactly what happened with the RU-whatever case involving the French abortion pill. A woman shows up at customs with the pills, after informing them of the fact before hand, customs arrests her for possession, and the case is in the courts. In this case, if someone is of a mind, they could preselect to get into the courts in a civil or criminal capacity. If you want a civil suit, petition the government to let you import the code, and if they refuse, you have the grounds for civil litigation. You could even raise money and make it a class action suit. If you desire a criminal suit, inform the government that you intend to import the code -- tell them how and when, and mention that you are interested in making this a test case -- and let them decide to either ignore it or charge you with a criminal violation. Now, I am not financially independent, nor do I possess the time and inclination to pursue either of these approaches. I do consider them to be rational and ethical methods of seeking redress from an unpopular law. -- Rob Stampfli rob@colnet.cmhnet.org The neat thing about standards: 614-864-9377 HAM RADIO: kd8wk@n8jyv.oh There are so many to choose from. =-=-=-=-=-= From: woody@cs.utexas.edu (James Woodgate) Newsgroups: sci.crypt,alt.security.pgp Subject: Re: PKP/RSA comments on PGP legality Date: 15 Dec 1992 15:52:31 -0600 In article <1galtnINNhn5@transfer.stratus.com> cme@ellisun.sw.stratus.com (Carl Ellison) writes: [stuff deleted] > >NOTE: The pgp documentation states that PKP acquired the patent rights >to RSA "... which was developed with your tax dollars..." This is very >misleading. U.S. tax dollars only partially funded researchers at MIT >who developed RSA. The U.S. government itself received royalty-free >use in return. This is standard practice whenever the government >provides financial assistance. The patents on public-key are no >different and were handled no differently than any others developed at >universities with partial government funding. In fact, almost every >patent granted to a major university includes government support, >returns royalty-free rights to the government, and is then licensed >commercially by the universities to private parties. > So taxpayers pay for research, if it doesn't amount to anything, they just lose the money. If it does amount to anything, they get to pay twice, once for the research, and then again when someone gets an exclusive patent by the University and charges licensing fees. If the government gets royalty-free use, then so should the people who put up the money in the first place, US taxpayers... BTW-The January issue of Popular Science has an article on encryption It states: "The computer industry would like NIST to adopt the RSA technology, but that isn't likely to happen. One reason: If the privately developed technology becomes a standard, the government will have to pay royalties for its use." -- ----------------------------------------------------------------- Linux Rules! woody@cs.utexas.edu pgp key available -> finger woody@cs ----------------------------------------------------------------- =-=-=-=-=-= Newsgroups: sci.crypt,alt.security.pgp From: stevens@vms.macc.wisc.edu (PAul STevens - MACC - 2-9618) Subject: Re: PKP/RSA comments on PGP legality Date: 15 DEC 92 14:01:19 In article <1992Dec14.204408.6485@news.cs.indiana.edu>, Marc VanHeyningen Whoever goes to court to test the patent claim had better darn well have >the resources and circumstances to mount a strong defense or else he'll >just get creamed and a precedent will be set in favor of PKP. It's not >something for some random doofus to challenge without significant >backing and knowledge. Making a frivolous violation and losing in court >does not help your cause; quite the contrary. > -----BEGIN PGP SIGNED MESSAGE----- ~From: stevens@vms.macc.wisc.edu (PAul STevens - MACC - 2-9618) ~Newsgroups: sci.crypt,alt.security.pgp ~Subject: Re: PKP/RSA comments on PGP legality ~Date: 15 DEC 92 12:17:07 Organization: University of Wisconsin Academic Computing Center In article <1992Dec14.204408.6485@news.cs.indiana.edu>, Marc VanHeyningen Whoever goes to court to test the patent claim had better darn well have >the resources and circumstances to mount a strong defense or else he'll >just get creamed and a precedent will be set in favor of PKP. It's not >something for some random doofus to challenge without significant >backing and knowledge. Making a frivolous violation and losing in court >does not help your cause; quite the contrary. I can tell I got your dander up. I wish we could get everyone's dander up. And by implying that I am a random doofus, you have come close to getting my dander up. So that is two of us...lots better than zero. My feeling is that PKP does not have a valid patent. If it turns out that they do, then more power to them. But by standing around and doing nothing we make it valid! Have they ever actually filed a complaint or tried this in a court? My gut feeling is that they are afraid to. They rely on our fear that they might. Where can we find a non-random doofus with resources? Does it help an eventual court case if PKP takes no action when violations are waved in their face? Violations are being waved every day as people discuss their use of PGP and publish their public keys. If I can be put away for computing 5**3 (mod 91) then something is amiss which I will have to learn to accept. Yet it does appear to be a violation of the patent. Maybe we should all sign our postings with PGP (to ensure that we are not being infiltrated by NSA ;-) ). What can we **DO** except stand around like sheep and bleat? I am willing to do my part, including taking risks, in almost any agreed upon plan. I never cease to be amazed by the collective cleverness of the NET. If everyone thinks the best stategy is to wait for the patent to expire and for our elected representatives to outlaw private cryptography then we should all quit using public keys and SHUT UP. PAul stevens@macc.wisc.edu -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUAKy4lv9hquDfl/NHyAQG8oQF+L4pXlABaq6f92JpMGPf7VTDZ06BvtdJl uzgjxTDNUDEgYqLWUDTYuLoW6dn8m+5+ =Nox8 -----END PGP SIGNATURE----- =-=-=-=-=-= From: cme@ellisun.sw.stratus.com (Carl Ellison) Newsgroups: sci.crypt,alt.security.pgp Subject: Re: PKP/RSA comments on PGP legality Date: 15 Dec 1992 20:34:57 GMT In article hmiller@lucpul.it.luc.edu (Hugh Miller) writes: > Mr. Bidzos gives the appearance of being a very effective lawyer, >representing the interests of his company, RSADSI/PKP, well. > Consider the post via Carl Ellison. By not making it under his own >name, but under Carl's headers, he achieves a double purpose. First, he >veils his threat. A veiled threat, of course, works better than a naked >one, since it leaves a greater measure of uncertainty in the mind of >potential end-users. And, after all, that is one of the principal aims >of the posting: to scare off potential end-users of PGP, currently the >world's most popular public-key encryption program. Second, he presents >the spectacle to the Net of an intimidated potential end-user, to wit, >Carl. This is also psychologically quite effective, as we in the >Internet community have the tendency to identify with Carl, being like >him. There has been a rush of postings on alt.security.pgp lately >urging the dropping of PGP for RIPEM. How very convenient. Success, so >far. [etc.] My posting was instigated by me. It was written by a group at PKP and RSA, including the corporate lawyer(s), I believe. [I tell lawyer jokes like anyone else, but do happen to have a number of lawyer friends (and one relative) so I don't write off lawyers totally. I'll listen and make up my own mind.] I don't see what RSA and PKP wrote as a veiled threat. I believe their intentions are well known. They want to continue making money off their patent. They, like us, would probably like to see the export laws become more rational (although I don't speak for them). They have even more reason to fear those export laws than we do since their very existence depends on not being shut down. I really believe that they need to keep their noses especially clean -- so I accept the argument that possible ITAR violations by PGP are enough for them to keep their hands off. No one at RSA used me in this posting. I had originally asked (months ago) if I could buy an individual RSA use license from them in order to make it legal for me to use PGP. I was turned down. From there, I continued the discussion and heard over several mail messages substantially what was in the posting. As I kept reading sci.crypt, I felt it was time to say something and was about to post from what I had learned in those exchanges but instead I wrote to RSA asking them if they'd like to post something. I would rather let them word it than do it all myself. They didn't want to post directly but were willing to write something which I could post. I agreed so that's what happened. I do not speak for RSA. I am not their employee. I do choose to honor their patent and obey the ITAR (I think/hope). [I use company computers and have been strongly advised to behave this way by my company's lawyers.] If I were to buy a PC for myself (which I've never bothered doing because the ones I get at work are so good, and I have free use of them in my own time :-), I don't know what I would use for security. I have RSAREF. I'd probably roll my own or use RIPEM (once it's finally released). Or, I might even buy a commercial package like MailSafe -- although I believe that PGP will set the worldwide standard for mail interchange just like UNIX set standards -- and for the same reason: it's free and therefore ubiquitous. What I use today is my own secret-key algorithm together with scripts which let me conveniently interface with Sun's Mail (or the VMS MAIL command). [I have versions for Sun, VAX VMS, Stratus VOS and soon to be MIPS. I'll probably port it to HP-UX soon. But this is just historical accident. If I were starting over today, I'd use compress|des|tran|des|tran|des and transmit the keys with RSA, using RSAREF. This would take a special modification to RSAREF, but I believe it wouldn't be hard to get.] --Carl -- <> -- Carl Ellison cme@sw.stratus.com -- Stratus Computer Inc. M3-2-BKW TEL: (508)460-2783 -- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298 FAX: (508)624-7488 =-=-=-=-=-= Newsgroups: sci.crypt,alt.security.pgp From: jgd@dixie.com (John De Armond) Subject: Re: PKP/RSA comments on PGP legality Date: Wed, 16 Dec 92 10:15:34 GMT strnlght@netcom.com (David Sternlight) writes: >Hugh Miller's article is filled with so many inaccuracies it's hard to >know where to start, so I'll treat only a few; the remainder is left >to others as it's pretty late at night. I'm going to digest, since the >message is so long. >He then decides to interpret Bidzos' comments as "threats" instead >of statements of fact about Bidzos' interpretation of the PKP patents >and the Munitions Act. I thought Miller's arguments well thought out and pragmatic. Fact is Bidzos IS saber rattling. If he thought he had a case, he'd prosecute it and forget about the munitions act angle. Patent law gives overwhelming bias toward the holder including early injuctive relief. Bidzos and PKP know that they are likely to lose the whole shebang if they press the case. Statistics alone play against them if my patent attorney is accurate in stating that about 75% of all patent validity challenges succeed. RSA is neither particularly novel nor unobvious to one engaged in the trade. That alone should do the trick without even delving into the legal issues involved with algorithm patents. Lastly, they stand a great chance of losing by virtue of lack of due dilligence in protecting their patent. PGP has been out, what, 2-3 years? No suits yet. Appears they don't care too much. Bidzos is trying a package deal. One part to scare those who fear a patent suit and to get the rest, he throws in a specious Munitions Act threat. Saber rattling at its finest. John -- John De Armond, WD4OQC |Interested in high performance mobility? Performance Engineering Magazine(TM) | Interested in high tech and computers? Marietta, Ga | Send ur snail-mail address to jgd@dixie.com | perform@dixie.com for a free sample mag Need Usenet public Access in Atlanta? Write Me for info on Dixie.com. =-=-=-=-=-= Newsgroups: sci.crypt,alt.security.pgp From: tcmay@netcom.com (Timothy C. May) Subject: RSA Data Security Not All Bad Date: Tue, 15 Dec 1992 20:09:24 GMT I thought I'd mention a few things that show RSA Data Security and Jim Bidzos (their President) to not be all bad, vis-a-vis the recent discussion of PGP and licensing of the RSA patents. First, I'm an occasional user of both MacPGP and MailSafe (for DOS only). Second, I posted the "Trial Balloon to Ban Encryption?" piece on Prof. Denning's ideas about key registration, so I'm not exactly a shill for the national security state. Having said this, I don't believe RSA Data Security is acting to limit the availability of their encryption products, as some have suggested. I agree that MailSafe, one of their standalone end-user products (and the closest thing they have to PGP), is not well-marketed...I had to contact them directly to buy a copy. But Jim Bidzos was so eager to get "hackers" to use MailSafe that he made a special offer. Mr. Bidzos authorized me to announce at the Hackers Conference in 1991, a year ago, that anyone attending the conference could get MailSafe for $50, a substantial reduction from the $125 price at that time (I have no idea what the current price is). The idea was that this would nearly eliminate the complaints of those who wanted their RSA encryption for free. (Personally, I'm opposed to software patents in general, and the patenting of the general math techniques used in RSA in particular. Patenting the kind of math used in RSA is akin to letting Trimble Navigation, for example, patent the Pythagorean Theorem just because they use it in their product. Rivest, Shamir, Adleman, Diffie, Hellman, and Merkle all deserve the fame they've gotten, but allowing a patent on a fairly simple number theory algorithm is wrong.) Several folks at that Hackers Conference took advantage of the offer. But not enough to make it "interesting" to use (meaning, too small a critical mass of users). I used MailSafe to secure some files, but never found anyone I wanted to communicate with who also had it. I even put "RSA MailSafe public key available" in my .signature for a while, but had no takers. This is in contrast to PGP, where about half the folks I correspond with use it, or at least have the capability to use it. This is why PGP has become the de facto standard for "hackers" and other amateurs (meaning, non-corporate users...and maybe a few folks in corporations). It seems to many of us that RSA Data Security is _helped_ by this situation with PGP. Yes, _helped_. Tens of thousands of users of PGP are grappling with the issues, learning the methods of RSA digital signatures and encryption, and are generally getting used to the idea of protecting their own mail and files. These PGP users are potential customers of future RSA Data Security products, either at their companies or, if priced reasonably and supported by RSA, for their own use. Furthermore, the existence of PGP and the rapid rate at which it is evolving (the latest release, 2.1, adds significant new features) is in stark contrast to the moribund MailSafe, which apparently has not changed since 1988. RSA Data Security may not like this "competition," but it may serve to light a fire under them to upgrade their end-user products. (I suppose RSA feels compelled to do something to protect their patent position, lest it be jeopardized by their inaction.) I haven't said anything about the various licensing deals with Lotus Notes, Apple, DEC, IBM, etc. These deals suggest RSA's technology is about to become widespread amongst corporate users, which is all to the good. (Provided there is no crippling of the security...I did hear a report that Apple's "Open Collaboration..." product may be forced to use a reduced-security version of RSA. If true, this is bad news.) Finally, another positive word about RSA Data Security. A year ago they sponsored a wonderful one-day free conference, in Redwood Shores, CA. That conference thoroughly trashed the government's proposed "Digital Signature Standard" (DSS), and helped mobilize the backlash against it. RSA stood to gain from this repudiation of DSS, but the conference was still very useful in illuminating the main problems with DSS. This year the conference is 2 days, January 14th and 15th. Call 415-595-8782 for details (but hurry, as I hear it is filling up fast). Granted, they are pushing their products. But this is also a service to the overall crypto community, and for that we should be appreciative. Just thought I'd find something nice to say about RSA Data Security. ---Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: by arrangement. =-=-=-=-=-= From: steppler@kaa.informatik.rwth-aachen.de (Martin Steppler) Newsgroups: alt.security.pgp Subject: PGP 2.1 available for Amiga Date: 16 Dec 92 16:08:56 GMT PGP 2.1 is available for the Amiga from: amiga.physik.unizh.ch [130.60.80.80] /amiga/util/crypt Martin -- Martin Steppler Phone: +49-241-158579 Internet: steppler@pool.informatik.rwth-aachen.de ADSP: steppler@cookies.egosoft.adsp.sub.org Fido: 2:242/7.12 Martin_Steppler@mowgli.fido.de ***** End Info-PGP Digest *****