HDTenEightyP/NetNews huggingface dataset:
From: tenney@netcom.com (Glenn S. Tenney)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Tue, 29 Dec 1992 07:43:59 GMT

I tried to keep quiet to get back to sci.crypt, but...

In article <1992Dec29.003205.19992@unislc.uucp> erc@unislc.uucp (Ed Carp) writes:
> ...
>  While it is true that
>publishing something doesn't automatically make it public domain, in some
>cases it may seriously weaken any claims of patent infringement.  Not all,
>of course, otherwise nothing would ever be published.  :)
>
>On proprietary non-disclosed material, the restrictions on disclosure must be
>fairly exacting, else one loses the protection afforded by declaring
>something a "trade secret".  Consider the Datapoint case of several years
>back.  Two programmers who had worked for Datapoint walked out with listings
>of Datapoint DOS, rekeyed it, then sold it.  The courts said that because
>Datapoint hadn't taken steps to protect their copyrighted material (like
>restricting access to listings and source code) they lost the protections
>afforded herein.

You are (a) confused on the laws, and (b) confusing patents, copyrights,
and trade secrets.

1. Publishing something NEVER places it into the public domain UNLESS
you publish is with a statement to that effect.

2. Various country's patent laws have different restrictions on when
and how you must apply for a patent.  For example, in the U.S., you can
publish something before applying for the patent -- but the clock
starts ticking to when you must file or it's too late.  In other countries,
if you publish before filing, you lose -- you can not file after that time.

3. Copyrights are VERY different from patents.  Too much to say here
except that basically patents protect the idea while copyrights protect
the expression of the idea but not the idea itself.

4. The Datapoint case mixes employment contracts, trade secrets, and
copyrights -- but we were talking about the RSA *patent*.

I suggest that you obtain a better understanding of intellectual
property issues.


-- 
Glenn Tenney
voice: (415) 574-3420      fax: (415) 574-0546
tenney@netcom.com          Ham radio: AA6ER
Newsgroups: sci.crypt
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: RSA Data Security Not All Bad
Date: 21 Dec 92 14:53:01 GMT
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg

strnlght@netcom.com (David Sternlight) writes:

> >Then the export restriction isn't protecting much, either.
> >
> referring to piracy of products overseas.

> I don't know if I understand him correctly, but it seems to me
> that's arguing that if there are lots of thieves one shouldn't
> bother with locks.

No, but if there are indeed many thieves, you shouldn't bother posting
a message "Theft is Forbidden by the Law"... :-)

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt,misc.legal
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PGP use Ethical and Legal Questions
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 23 Dec 92 13:25:35 GMT

rick@ee.uwm.edu (Rick Miller) writes:

> Essentially, RSA's RSAREF license says, "Because this is our proprietary
> algorithm, we're going to dictate that you only implement it with our source-
> code."   The RSAREF license forbids any changes (other than those needed to
> port it, in C only, to other architectures).  This means that you're not even
> allowed to *improve* it!  I'm sure that someone could find a way to run their
> algorithm more efficiently, quicker, etc. ... but that's not allowed.

Is it really not allowed? Did I understand the license incorrectly? I
think it clearly says that any modifications of the code can be made,
provided that the interface stays the same and you give them a copy of
the modified code...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt,alt.security.pgp
From: erc@unislc.uucp (Ed Carp)
Subject: Re: PGP as a World Standard
X-Newsreader: TIN [version 1.1 PL6]
Organization: Unisys Corporation SLC
Date: Tue, 29 Dec 1992 00:39:29 GMT

David Sternlight (strnlght@netcom.com) wrote:

: Vesselin Bontchev asks why I don't revoke my key. The reason is because
: now that I understand the legal position I won't use PGP. To revoke

Why do you believe that using PGP is illegal?  According to PKP, it is
clearly within the rights of an individual to use PGP for one's own personal
use, among other uses that are allowed by PKP and not considered infringements.
Besides, I am puzzled as to how someone can claim an exclusive monopoly on
technology invented while they were on the public payroll (the RSA algorithm
was developed at MIT).
-- 
Ed Carp			erc@apple.com, erc@saturn.upl.com	801/538-0177

Who and what would you be if you went beyond your deepest fears?
Newsgroups: sci.crypt
From: rosa@isy.liu.se (Ronnie Sahlberg)
Subject: What algorithm to use in my project...?
Organization: Dept of EE, University of Linkoping
Date: 23 Dec 92 14:35:21 GMT

Hi, crypto-men .

I am currently working on a hw/sw project where we need to use some crypto
stuff. My problem is that I dont know which cryptation algoritm to use.
It is very important that the cryptation is HARD (impossible) to crack,
otherwise our whole project is useless.
The following restrictions apply to this project :
1, Each message to encrypt is 10 to 15 bytes.
2, We can only allow about 5.000 assembler instructions to decrypt 
   each message.
3, Some messages will be sent to just one reciever, and be decrypted
   and interpreted in said reciever. Some messages will be sent
  to several (all) units and will be recieved, decrypted and interpreted
   by all these units.
   Thus we must keep the decryption algorithm in 'sync' on all units.
   To make things worse, we MUST also be prepared for that some units
   can be disconnected and thus miss some messages and still work
   (not be out of sync) when the uni9t is turned on again.
4, The chip will probably be built in the US but sold/used in
   europe. So I cant use an algorithm that may not be exported outside
   the US.

If anyone has any suggestions on which algorithm to use I would be 
very glad. If you know what cryptation algorithm to use, please let me
know, and if you also know where to get source and documentation to said
algorithm, GREAT!

Please do not respond by e-mail, my e-mail server is _UNRELIABLE_
at the moment and will probably not start working properly until late january.

ronnie s , ronnie@lysator.liu.se

Newsgroups: sci.crypt
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: PKP/RSA comments on PGP legality
Organization: /usr/local/lib/news/organization
Date: Wed, 23 Dec 1992 02:35:18 GMT

strnlght@netcom.com (David Sternlight) writes:
>
>Marc VanHeyningen asks "what license fee?" for RSAREF.
>
>I guess I have to spell it out. Some have argued that the most PKP
>could collect in a successful patent lawsuit is damages, i.e. license
>fees not paid, i.e. zero since RSAREF carries none.
>
>My post pointed out that PKP could also get legal fees.

But as my post has pointed out, it is rather unlikely given US Civil
law that anyone could recover legal fees as they are not routinely
awarded to the winner. Dan Quayle's Council on Competitiveness felt
that this was the reason lawsuits occur so much more often in the US
and wanted statutory reform that would change our system to follow the
U.K. rule under which fees are awarded.

I may be wrong about this, but I seriously doubt it.
--
Perry Metzger		pmetzger@shearson.com
--
Laissez faire, laissez passer. Le monde va de lui meme.
Newsgroups: sci.crypt
Subject: Re: Legal Stuff!
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 22 Dec 92 17:47:57 GMT
Organization: Beckman Instruments, Inc.

In <1992Dec22.092736.21737@netcom.com> tenney@netcom.com (Glenn S. Tenney) writes:

>Is it likely that either the Feds or RSA will come after
>someone?  I don't know, but the more people using PGP at
>large US corporations or universities, the more likely
>it is (in my guess) that RSA will choose one as an example.

If they go after someone big, they have more of a risk of losing
everything.  In the case of the Feds, the entire ITAR restrictions on
software (as they apply to public domain software) are unlikely to survive
a Constitutional test.  In the case of PKP, they could lose the patent if
they go after someone with enough money to defend the case.


--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Xref: sparky sci.crypt:6211 alt.security.pgp:436
From: injc@sun.rz.tu-clausthal.de (Joerg Czeranski)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: 27 Dec 92 17:19:17 GMT
Organization: Techn. Univ. Clausthal
X-Newsreader: Tin 1.1 PL5

David Sternlight (strnlght@netcom.com) wrote:
: I suggest that if present-day Bulgaria wishes to gain the benefits
: of membership in the international economic community, or the EEC, it
: will have to bring its intellectual property laws in line, and until
: then, many of its actions constitute stealing according to international
: norms, even if not under the laws of Bulgaria.

Regarding this, you are certainly right, when discussing copyright,
but I do not think that patents on algorithms are international norms
even though they exist in the U.S.  (Sorry, if I misunderstood you and
you didn't want to apply your statement to patent laws, flames to /dev/null)

Joerg

--
Joerg Czeranski
Osteroeder Strasse 55          EMail injc@sun.rz.tu-clausthal.de
W-3392 Clausthal-Zellerfeld    SMTP  injc@[139.174.1.3]
Germany

PGP Public Key will soon be available upon request.

(.sig under construction, sorry for the inconvenience)
Newsgroups: sci.crypt,alt.security.pgp
From: phr@telebit.com (Paul Rubin)
Subject: Re: export rules -- a new wrinkle
Organization: Telebit Corporation; Sunnyvale, CA, USA
	<1992Dec23.062629.14901@netcom.com>
Date: 22 Dec 92 23:02:17

    Doesn 't SLIP or PPP access require password validation? If so,
    it would be the site's responsibilty to assure that the above
    rules were complied with, yes?

No.  Authentication is optional.
Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sat, 26 Dec 1992 18:37:58 GMT

In article <BzvAs7.sI@mentor.cc.purdue.edu> hrubin@mentor.cc.purdue.edu (Herman Rubin) writes:
>In article <1992Dec26.110116.1258@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>
>>Steve Gardner writes:
>>"Imagine having to pay Newton for the 
>>        algorithm for calculating the derivative of a polynomial."
>
>>Actually, Sir R.A. Fisher did something somewhat analogous to that
>>(the publication/ academic equivalent). He invented the method of
>>maximum likelihood, a powerful general method for deriving all sorts
>>of statistical tests, and kept it a secret. He then derived one test
>>after another, published each one separately in the journals, and got
>>payment for each usage of the method, in effect, in the form of kudos
>>if not money.
>
>This is the utter nonsense put out by the admirers of Sir Ronald who
>keep blissfully unaware of what everyone else knew and did.  I do not
>doubt that he rediscovered maximum likelihood, and that mathematical
>statistic was in the doldrums at that time, but there were those who
>knew the at least century old method, and were using it quietly.

Don't complain or assert "utter nonsense" to me, Herman Rubin; I got
the account directly from my old M.I.T. Statistics Professor, R.A.
Freeman. As a famous and well informed Professor (perhaps you know his
works), he'd hardly have been "blissfully unaware of what everyone else
knew and did."

David

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: rja14@cl.cam.ac.uk (Ross Anderson)
Newsgroups: sci.crypt
Subject: Re: Enigma, ULTRA
Date: 1 Jan 93 11:55:32 GMT
Organization: U of Cambridge Computer Lab, UK

In article <1489@eouk23.eoe.co.uk>, ahaley@eoe.co.uk (Andrew Haley) writes:
 
|> Does anyone know of any technical description in the open literature
|> of the work done at Bletchley Park during WW2?

The book you are looking for is:

	Gordon Welchman, `The Hut Six Story', McGraw-Hill, 1982

Welchman was one of the men who actually broke the Enigma, and he had a 
senior role at GCHQ for years after the war.

I would strongly recommend that anyone with a serious interest in 
cryptology should read his book.

In addition to telling how the Enigma was broken, it is the definitive 
source on the mechanics of production cryptanalysis - running a chain of 
intercept stations, designing and commissioning keysearch machines, 
translating, evaluating and distributing the product, and using 
disinformation to stop the enemy realising what's happening.

Ross
Newsgroups: sci.crypt
From: bs@gauss.mitre.org (Robert D. Silverman)
Subject: Re: Are Lucas sequences an alternative to RSA?
Organization: Research Computer Facility, MITRE Corporation, Bedford, MA
Date: Tue, 29 Dec 1992 00:30:35 GMT

In article <Bzzp1F.MEy@netnews.jhuapl.edu> jensen@aplcomm.jhuapl.edu (Robert Jensen) writes:
:The January 1993 Dr. Dobb's contains a description of the use of
:Lucas sequences as an alternative to RSA for public key encryption.
:I seem to recall a previous assertion in this group that the
:Lucas sequence system is just a disquised RSA.  I don't recall any
:details of the assertion or any follow up discussion.  Does anyone have
:an opinion on this alternative?  The advertised advantage is that the
:encrypted product of two messages is not the product of the individually
:encrypted messages.  This beats at least one attack on RSA.

This last assertion is not correct. The same type of attack will (when
possible) defeat the Lucas method as well.

I was the one who posted the opinion. I did not say that using Lucas
sequences was a disguised form of RSA. Rather it is a disguised form
of discrete logs. And the "product" of two messages is the product of
individual messages if one interprets "product" correctly.

Once more, 

Using Lucas sequences is essentially the discrete logarithm method
for the sub-field (or sub-group) of GF(p^2) that has order p+1.
This is known as the twisted group (or field). Multiplication 
within this sub-field or sub-group is not ordinary multiplication mod N,
but is rather a composition which amounts to adding the indices of
two elements in a Lucas sequence. That is to say, if A_h and A_j are
two elements in this sequence, then their "product" is A_(h+j).

Exponentiation in this sub-field is done by appropriate compositions
using the Lucas sequence, whereas exponentiation for RSA is done via
modular multiplication.

The "new" method appears to be valid, but it is well known among
number theorists and cryptographers. It amounts to the discrete log
problem for a PARTICULAR sub-field of a finite field.

--
Bob Silverman
These are my opinions and not MITRE's.
Mitre Corporation, Bedford, MA 01730
"You can lead a horse's ass to knowledge, but you can't make him think"
Newsgroups: sci.crypt
Subject: Re: Legal Stuff!
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 21 Dec 92 22:32:00 GMT
Organization: Beckman Instruments, Inc.

In <1992Dec21.203115.12176@netcom.com> strnlght@netcom.com (David Sternlight) writes:

>No, it carries two separate thoughts: 1. PGP cannot be imported legally
>since it violates RSA's patents. Patents cover copying, possessing,
>or use, and where Vesselin got the idea U.S. patents cover only
>use is beyond me.  2. PGP cannot be imported legally since
>it violates the Munitions Act/ITAR, which requires a license for
>importing, as well as exporting crypto, and PGP contains IDEA.

(1>) Do you have any basis for your premise that a computer program CAN
infringe a patent?  My understanding of the law (confirmed by some experts)
is that, as we don't have algorithm patents in this program, a computer
program alone cannot be covered by a patent.  The program must be RUNNING
on a computer before there is any infringement.

(2>) We've gone through this.  I haven't tracked the exception to the
exception to the exceptions in the regulations, but it is unclear whether
"public domain" (meaning essentially, published) crypto software is covered
by ITAR.

>Next Vesselin claims U.S. users may obtain PGP legally from a number
>of U.S. sites, which he lists. He is mistaken. It is on those sites
>illegally, for reasons stated just above, and ftping them to other
>U.S. sites is just as illegal. It does not matter who did the
>importing; possession of illegally imported munitions is illegal.
>Maybe in Bulgaria what is physically possible is equivalent to what is
>legal, but not in the U.S.

See (1>) above re patents.

Re ITAR, see (2>) above.  In addition, it is not clear to me that
possession of illegally imported "munitions" IS illegal.  It may be, but
the law is sufficiently unclear that it might not be.


--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: eoliver@ralph.cs.haverford.edu (Erik Oliver)
Subject: Re: Legal Stuff!
Organization: Haverford College Computer Science Department
Date: Sat, 26 Dec 1992 00:13:53 GMT

Well, David, I'm glad you feel I have integrity behind my statement, I
suppose it comes from a sense, in which I feel that my whole life is a
form of protest.  As a gay male living in this country, I feel like
every moment since I cam out 4 plus years ago has been a protest to get
the rights I deserve.

I wish that I had the financial capability to stand behind my position
here, but I don't at present.  But, that doesn't dampen my enthusiasm
or the integrity of my statement, it just means that I can't afford to
participate in the "system" which we are forced to live in.

A system, which I might add, allows my bosses in almost every locality
in the United States to fire me and use as a reason, "Well, I don't want
any faggots working here."   Bleahg.  I have too many battles which are
so deeply connected to my life to fight, but I see this as a related
one, the right to privacy is essential.  And by holding a copy of pgp, I
can voice my protest.

So, now, with all that lifted off my shoulder in an unloading of a year
of anger and hostility towards this country, I do feel better.  I would
however, love to help someone organize a challenge against the munitions
act and PKP patent.

-Erik
Newsgroups: sci.crypt
From: smb@research.att.com (Steven Bellovin)
Subject: Re: [legality of PGP etc.
Date: Sat, 26 Dec 1992 14:53:52 GMT
Organization: AT&T Bell Laboratories

In article <1hgedgINNbn0@leela.CS.ORST.EDU>, mcbeeb@atlantis.CS.ORST.EDU (Brian Mcbee) writes:
> I have heard mention several times here the possibility of forcing a test
> case with PKP over PGP.  I don't believe this is possible.  I think PKP
> has to sue an infringer.  It is therefore totally up to PKP as to whether
> this ever goes to court.

Nope.  For example, MCI just filed a lawsuit seeking to have some AT&T
patents declared invalid.  And AT&T hasn't sued them; it's simply filed
a complaint with the FCC.  (Source:  articles this week in the Wall Street
Journal and on the AP wire.)
From: karn@servo.qualcomm.com (Phil Karn)
Newsgroups: sci.crypt
Subject: Re: PGP - Legal?
Date: 4 Jan 93 04:19:30 GMT
Organization: Qualcomm, Inc

In article <1993Jan4.030425.7578@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>We were talking about what's possible. Phil should read the munitions
>act some day.

I have, at length. (Well, actually the ITARs, which are authorized by
the Munitions Act).  I have also consulted an attorney who specializes
in export control issues.  The rules are, at best, deeply ambiguous
when it comes to freely available public domain software. However,
chances are also very good that any attempt to apply them to such a
case would be tossed out of court. (Why do you think that no such case
has ever been brought?)

The ITAR writers clearly never envisioned that software would be
freely given away. The assumption was that software, especially source
code, would be proprietary. Like the detailed plans to, say, the
avionics of an F-15, which are not available at my local Comp USA
store or by anonymous FTP over the net. But crypto software *is*
freely available from these places, and has appeared in quite a few
publications (a partial list of which I posted here recently).

Perhaps David Sternlight should read the First Amendment to the
Constitution of the United States some day.

>Phil seems to think that calling attention to the facts makes one
>a right-wing Republican. He is way off base.

You're right. The political spectrum goes much further than
"right-wing Republican"...

Phil
Newsgroups: sci.crypt
Subject: Re: PGP - Legal?
Summary: 
Expires: 
Followup-To: 
Distribution: 
Organization: Qualcomm, Inc
Keywords: 
Xref: sparky sci.crypt:6128 alt.security.pgp:407