From: anon.49@pax.tpa.com.au
Newsgroups: alt.drugs
Subject: A reply to PKP bullsh*t about PGP legality
Date: 23 Dec 92 20:33:50 GMT
Reply-To: anon.49@pax.tpa.com.au
Organization: PAX - Public Access Unix (Adelaide,South Australia) - Anonymous Service
NNTP-Posting-Host: flash.pax.tpa.com.au


|    Mr. Bidzos gives the appearance of being a very effective lawyer,
|representing the interests of his company, RSADSI/PKP, well.
|    Consider the post via Carl Ellison.  By not making it under his own
|name, but under Carl's headers, he achieves a double purpose.  First, he
|veils his threat.  A veiled threat, of course, works better than a naked
|one, since it leaves a greater measure of uncertainty in the mind of
|potential end-users.  And, after all, that is one of the principal aims
|of the posting: to scare off potential end-users of PGP, currently the
|world's most popular public-key encryption program.  Second, he presents
|the spectacle to the Net of an intimidated potential end-user, to wit,
|Carl.  This is also psychologically quite effective, as we in the
|Internet community have the tendency to identify with Carl, being like
|him.  There has been a rush of postings on alt.security.pgp lately
|urging the dropping of PGP for RIPEM.  How very convenient.  Success, so
|far.
|    The issuance of credible and effective threats constitutes a large part
|of the work of a lawyer.  Threats are much less expensive than actual
|lawsuits, and less risky (one can lose a lawsuit; one cannot `lose' a
|threat).  It is a cardinal rule of actual legal practice that one should
|postpone as long as possible going to court over a situation which is
|already favorable to you _in re_.  Mr. Bidzos's company makes a modest
|income from the (few) licenses it has issued to software developers, and
|it wouldn't be prudent, as they say, for him to risk going to court and
|subjecting the RSA patent (and his investors' capital) to the glaring
|light of a public trial, when he can achieve his ends by intimidation
|and innuendo.  But this does not means that we, the readers and targets
|of his threats, need to take them at face value.
|    Mr. Bidzos claims that we should avoid using PGP because it is
|"tainted by serious ITAR violations."  If it has fallen to the likes of
|Mr. Bidzos to prosecute PGP developers, distributors, and users under
|the ITAR, then the Reagan Revolution's privatization-of-government
|schemes have gone farther than we thought.  Mr. Bidzos does _not_ speak
|for the federal government, although he may well have been speaking _to_
|that government's agents about PGP.  Some branch or other of the federal
|government may well be bothered by the existence of PGP, but it would be
|unlikely that any prosecution would be mounted by a federal agency
|without a prolonged consideration of the political risks this would
|involve.  The Feds are still smarting over the Phasorphone and DES
|debacles, not to mention NSA's failed attempt to wangle control of
|crypto funding from the NSF, and the current bad publicity over the
|FBI's "digital telephony" scheme.  I hardly think they would be eager to
|climb back into that saddle just yet, knowing the public outcry that
|would greet such an attempt.
|    As to Mr. Bidzos's claim that by simply posting PGP on a BBS, "you
|have exported it," this is laughably absurd.  There are literally
|hundreds of "data security" programs floating around the Internet and
|the BBS world.  Some employ DES; some their own `miracle' proprietary
|schemes.  All are examples of "privacy devices, cryptographic devices
|and software (encoding and decoding), and components specifically
|designed or modified therefore."  For all the years these little
|file-scramblers have been making it into the public domain, Mr. Bidzos
|has managed to keep his zeal for the law in check. But ah, all of a
|sudden up pops a public-key cryptosystem with source code supplied and
|he is filled with patriotic elan.
|    Is Mr. Bidzos actually trying to goad the federal government into
|launching some kind of major criminal prosecution against everyone who
|has had a hand in the development or distribution of PGP?  ITAR statutes
|are criminal statutes; if you're convicted under them, you're looking at
|hard time in Leavenworth.  Is he seriously advocating prison sentences
|for these persons, or for end-users of PGP? Is such a position really in
|the best interests of his company, from any standpoint, since he is
|actively promoting the same technology himself? If such a prosecution
|actually were to go forward, cryptography in general would suffer, and
|RSADSI/PKP along with it.
|    But what about the protection of the patent rights held by Mr.
|Bidzos's company -- which it is his true and only aim to protect, ITAR
|burblings being a side issue?  What, then, are we to do, if we wish to
|avail ourselves of the powerful assymetric cryptosystems which,
|RSADSI/PKP claims, are all covered by their patent?  It appears that we
|cannot just go to the library, Xerox up Rivest, Shamir, and Adleman's "A
|method for obtaining digital signatures and public key cryptosystems"
|(CACM 21(2), 120-6, Feb. 1978), and devote a few hundred hours to
|banging up an C implementation.  The RSA algorithm is covered by a
|patent, #4,405,829 (issued 20 Sept. 1983).  RSADSI/PKP is the sole
|assignee of the patent, held by MIT.  They also have acquired the rights
|to three other PK systems and are apparently claiming patent rights to
|the very idea of public-key cryptography, which, unless I read the
|literature wrong, was first published by Whit Diffie and Martin Hellman
|("New directions in cryptography," IEEE Trans. Info. Theory, IT22,
|644-54, Nov. 1976).
|    Mr. Bidzos advocates adoption of "a program, including source code,
|called RSAREF," from RSADSI.  Yet RSAREF is, to my knowledge, not a
|complete program, but a set of subroutines which do a specific, limited,
|and inflexible number of mathematical operations on given input data.
|It is by no means a full program, and it would require a great deal of
|work to build it up into one.  (I have never seen any "rsaref" compiled
|object code for any machine, any platform; only source code.  And it is
|my understanding that we would not even have RSAREF in the public domain
|had it not been crowbarred out of RSADSI/PKP by the terms of one of
|their federal grants. So RSAREF represents an algorithm for which we, the
|taxpayers, have paid _twice_.  Mr. Bidzos claims that it is being
|offered for "free.")  Even if one were to build a PK system upon RSAREF,
|it would lack much of the flexibility and functionality of PGP, which
|utilizes quite different data structures for its keys, key certificates,
|keyrings, etc. etc. RIPEM, built upon RSAREF, from the beta version I
|have seen (and which I downloaded by anonymous ftp from scss3.cl.msu.edu
|two weeks ago, before the ftp archive there was closed to anon-ftp
|access), is a slower program with fewer options and much less
|functionality than PGP, especially on a non-Unix platform.  It keeps
|both the plaintext and encrypted text in memory together, and thus
|imposes limitations on many end-users with small memory allocations.
|Unlike PGP, it cannot do symmetric (private-key) encryption.  It lacks
|the ability to sign public keys.  It relies heavily upon a centralized key
|distribution authority (although it can be used without such), which PGP
|does not.  For its single-key cipher it utilizes, ahem, DES.  Unlike
|PGP, there is no current version for Macintosh and compatible computers.
|And the docs for 4.2(beta) indicate that even its own author, Mark
|Riordan, is unsure that "the current RSAREF license allows free personal
|use of RIPEM by citizens of the United States and Canada."  He _thinks_
|it does. "However," he notes, "this personal interpretation has no legal
|standing, and RIPEM users are urged to read the RSAREF license agreement
|themselves."  And Mr. Bidzos would like us to be reassured by this?
|    Mr. Bidzos urges us to avail ourselves of MailSafe, RSADSI's
|proprietary end-user package (for Mess-DOS environments).  Apparently
|MailSafe is obtainable only by direct mail order from RSADSI.  A call
|this morning to the biggest local retailer of PC hardware and software
|in Chicago, Elek-Tek, revealed that they had never heard of MailSafe,
|and none of their distributors carries it.  The same with CompUSA, in
|Skokie.  A call to Egghead Software, one of the biggest national chain
|software retail dealerships, revealed that they had never heard of
|MailSafe, and none of their distributors carries it.  One could go on
|and on.  This is hardly the aggressive marketing one would expect from a
|firm with a lock on a patent of critical importance to Americans in the
|Information Age.  Albert Einstein worked in a patent office, but it
|never occurred to him to patent the theory of special relativity.  If he
|had, and had assigned the patent to Bidzos & co., the world's first
|cyclotron would still be nothing but drawings in a grant proposal.
|    Mr. Bidzos and his co-workers at RSADSI/PKP may feel that, at some
|point, they must go to court to protect the patents they claim.  But as
|prudent lawyers they must not relish the prospect.  They risk a lot: not
|just the patent(s), but the immensely bad publicity they would get from
|such an action.  Any victory they would win would be Pyrrhic, given the
|immense fund of ill-will towards the issue of algorithmic patents
|generally and these ones in particular evident in the computing
|community.  The ACM recently adopted a code of ethics which includes
|among its "General Moral Imperatives" the stipulations that, "As an ACM
|member I will... 1.5 Honor property rights including copyrights and
|patents, ... 1.6 Give proper credit for intellectual property."  These
|stipulations are already generating heat among ACM members.
|(Ironically, "General Moral Imperative" # 1.7 obliges ACM members to
|"Respect the privacy of others.")  I cannot believe that RSADSI/PKP
|would think it worth their while to pursue a suit like this against a
|freeware product produced by a worldwide group of relatively penniless
|but widely admired computer professionals.
|    In the Information Age, in which we have been living for a long time
|now, innovations like PK cryptosystems and David Chaum's untraceable-
|transactions techniques will become crucial to the protection of our
|rapidly diminishing privacy.  They afford end-users the ability to take
|effective control of the security of their communications and of the
|availability of information about them, without having to trust to the
|benignity of government agencies.  In this new world, they ought to be
|freely and widely available.  To bar their use, or the dissemination of
|knowledge concerning them, would be to deprive citizens of effective
|means of preserving their own privacy.  Privacy means nothing if
|effective means to preserve it are lacking.
|    Consequently, I for one am not afraid to stand up and be counted as
|a supporter of the fine work of the PGP development team, and especially
|of Phil Zimmermann, who got the ball rolling with version 1.0.  The
|program currently has far more users and admirers than any other
|public-key encryption system, and for good reason.  It is an elegant
|piece of work, made more elegant with each revision.  Nor am I afraid to
|put myself on record as a principled opponent of the RSA patent (and of
|algorithm/software patents generally), and as an opponent of the
|regulation by the government of cryptographic import/export/use in any
|form.  If my doing so creates any legal exposure for me, then that is a
|risk I am prepared to take for the sake of the proverbial `eternal
|vigilance.'  If it actually ends up costing me or other like-minded
|American citizens, then, in my view, this country's Constitution will
|have suffered yet another humiliating debasement.
|
|    Hugh Miller
|    Department of Philosophy
|    Loyola University Chicago
|    Moderator, Info-PGP Digest
|    info-pgp-request@lucpul.it.luc.edu

--
** Anonymity & Privacy by PAX - Public Access Unix (Adelaide,South Australia) **

anon.admin@pax.tpa.com.au (a human)    anon.info@pax.tpa.com.au   (for help)
anon.ping@pax.tpa.com.au  (get alias)  anon.key@pax.tpa.com.au    (register key)
anon.###@pax.tpa.com.au   (reply)      anon.post.g@pax.tpa.com.au (post to g)
anon.list@pax.tpa.com.au  (to mailing list)
anon.subscribe@pax.tpa.com.au          anon.unsubscribe@pax.tpa.com.au

For dialup Unix access phone +61-8-235-9010 - online registration.