HDTenEightyP/NetNews huggingface dataset:
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP v. 2.1 Released
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 19 Dec 92 00:08:06 GMT
Organization: Beckman Instruments, Inc.

In <1992Dec18.224331.7046@netcom.com> strnlght@netcom.com (David Sternlight) writes:

>In article <a_rubin.723923379@dn66> a_rubin@dsg4.dse.beckman.com (Arthur 
>Rubin) writes:
>>
>>Well, the patent may be invalid, and it may not cover the algorithms uses
>>in PGP (if it does, it is IMHO too broad), 

>and if my grandma had baytzim she'd have been my grandpa. Amazing
>how many rationalizations are being invented by many here, not
>just Rubin, to justify a wrong.

>>and PKP (the patent holder),
>>although they claim to license anyone in the US to use it for a nominal
>>fee, refuse to license Zimmerman or the current updater of PGP.

>Surely there's no compulsion on a patent holder to license what they
>consider to be a violation, after the fact. Both PGP 1.x and 2.x were
>presented as faits accompli. There was no advance request or
>inquiry about licensing. In fact, as I read it the notion of licensing
>came up after PKP objected. Hardly clean hands, if accurate.

>David

All PGPs are legal and ethical outside of the US.  This last comment adds a
slight ethical question for use within the US.  It doesn't effect legal
arguments.

--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Newsgroups: alt.security,sci.crypt,talk.politics.misc
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP v. 2.1 Released
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Thu, 17 Dec 1992 00:13:15 GMT


To clarify Peter Boucher's post, the reason permissions were put on the
ripem files, and they now require an account, is to control distribution
to the U.S. and Canada, in order not to violate the Munitions Act. Since
ripem uses DES, it must obey the same distribution rules DES has, in the
U.S.

My guess, therefore, is that when ripem is released, which is imminent,
it will only be available formally to users in the U.S. and Canada and
some sort of permission/account or other control mechanism will
continue. In addition to the Munitions Act issues, those who receive
ripem will have to agree to the RSAREF agreement, and thus some assent
mechanism is going to be required.

Note that the above is my understanding at the moment; I don't speak for
the ripem author, Mark Riordan, nor for the U.S. government, nor for
RSA/PKP.

David
Xref: sparky alt.security:5063 sci.crypt:5665 talk.politics.guns:25188 talk.politics.misc:64162 alt.security.pgp:165
From: russotto@vnet.ibm.com (Matthew T. Russotto)
Date: Mon, 14 Dec 92 08:53:08 EST
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP v. 2.1 Released
Disclaimer: This posting represents the poster's views, not those of IBM
News-Software: UReply 3.0
            <palmer.724336017@news.larc.nasa.gov>

In <palmer.724336017@news.larc.nasa.gov> Michael T. Palmer writes:
>
>Thank you for clearing this up.  Someone else on the net (I believe it
>was David Sternlight) also mentioned this to me a while back, but since
>so many recent posts recommended switching to RIPEM, it seemed to me
>(and many others, I guess) that the program was now widely available.

>to be told we should switch to a program we can't even get our hands on
>yet, and away from a program that works now (even though the legality of
>use is still being debated).

Who's to say RIPEM's legality won't be debated too?  As I recall, PKP
claims a patent broad enough to stop ANY public key scheme-- they claim
to have the use of arithmetic in a public key scheme patented....
Newsgroups: alt.security,sci.crypt,talk.politics.misc,alt.security.pgp
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: PGP as a World Standard
Organization: /usr/local/lib/news/organization
Date: Fri, 18 Dec 1992 21:42:55 GMT

strnlght@netcom.com (David Sternlight) writes:
>
>mathew argues as if PGP was some European invention we have a problem
>with in the U.S. That's a distortion of the real situation.
>
>Read my lips. PGP1.0 was contraband in the U.S., so much so that the
>author pulled out. It was illegally exported.  PGP2.0 was based on it.
>Thus the Europeans who use it don't have clean hands, regardless of
>the state of the law there.
>
>BEING DISHONEST WITH AN EXPLANATION ISN'T THE SAME AS BEING HONEST.

In other words, you are not arguing law, which you agree isn't an
issue here, you are arguing morality. Well, morality is a very
personal thing, and most of ours are diametrically opposed to what
yours seems to be in this instance. I think that the people who
created PGP were being PERFECTLY honest, and that it is the law that
says that they were not which is wrong. Certainly, as you acknowledge,
law is not always a good way to evaluate morality. Since we disagree
about a subjective issue, prehaps we could end this discussion right
here and you could leave us alone from here on out, as we aren't going
to listen to you and there isn't much other point in your moral
crusade against the evils of PGP.

--
Perry Metzger		pmetzger@shearson.com
--
"They can have my RSA key when they pry it from my cold dead fingers."
Newsgroups: alt.security
From: robert.heuman@rose.com (robert heuman)
Subject: PGP v. 2.1 Released
Organization: Rose Media Inc, Toronto, Ontario.
Date: Fri, 18 Dec 1992 07:27:01 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 12-18-92 02:15
kyle@uunet.uu.net (Kyle Jones) replied:

K(> Unless you do something that aggravates our authorities enough,
K(> in which case they will come across the border and get you.

In which case they will have to kidnap me and be subject to 
extradition to Canada for violation of Canadian LAW. Of course, then 
the RCMP could go into the US and get the authorities who came and got 
me, to bring them back here... and remember, they always get their 
men... BTW, this happened to some US bounty hunters.  They kidnapped
someone in Ontario wanted in the US and took him back.  They were
extradited and convicted.  Still in Kingston Pen, if I remember...

Bob Heuman <robert.heuman@rose.com>
---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: kadie@cs.uiuc.edu (Carl M. Kadie)
Subject: Re: PGP as a World Standard
Organization: University of Illinois, Dept. of Comp. Sci., Urbana, IL
Date: Wed, 16 Dec 1992 23:13:10 GMT


strnlght@netcom.com (David Sternlight) writes:

[...]
>Let's take a closer look at that. PGP 2.x was written in Europe
>based on PGP1.0. PGP 1.0 was illegally exported from the U.S.
>In the U.S. PGP was based on RSA's patents, and used them
>without permission, i.e. it was stolen goods.
[...]

kadie@cs.uiuc.edu (Carl M. Kadie) writes:

>I believe the term is "smuggled", not "stolen".
>
>(Likewise the term for violating a patent or copyright is "enfringe".)
[...]

Whoops, I mean "infringe".

- Carl
-- 
Carl Kadie -- I do not represent any organization; this is just me.
 = kadie@cs.uiuc.edu =
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: PGP as a World Standard
Organization: /usr/local/lib/news/organization
Date: Thu, 17 Dec 1992 19:12:01 GMT

strnlght@netcom.com (David Sternlight) writes:
>
>Ross Anderson correctly points out that New Zealand isn't part of
>Europe. Others have caviled at my use of the term "stolen goods."
>
>These are all legalisms. The point i was making has to do with the
>notion of "clean hands." If one creates PGP1.0 in the U.S. as
>a violation of somebody's ownership/patent rights, it is 
>"contraband" (like that word better for those who quibble to
>make what is clearly unethical "right"?). The act of moving
>that item to another country where the patents don't apply
>(as distinct from programming from scratch in that country)
>doesn't alter the fact that the item is tainted.

Actually, it does. The other country's laws might not recognise or
care about the U.S.'s laws. For instance, if the IRS thinks you owe
taxes, and you flee with the money to Switzerland, the Swiss will NOT
send you back to the U.S. because as far as they are concerned you
have committed no crime. There is no obligation for a European citizen
living in Europe not to use an object on European soil manufactured in
contravention of U.S. patents in the U.S.; indeed, I doubt you could
find a country with such a rule. "Contraband" only applies, I believe,
to something that violates the laws of the country it is smuggled
into. The "taint" wouldn't be recognized under the laws of most
countries so it doesn't matter.

Basically, you don't have a leg to stand on. Don't worry, though. You
can keep posting if you like.

--
Perry Metzger		pmetzger@shearson.com
--
"They can have my RSA key when they pry it from my cold dead fingers."
Xref: sparky alt.security:5113 sci.crypt:5792 talk.politics.misc:64675
From: pcl@ox.ac.uk (Paul C Leyland)
Newsgroups: alt.security,sci.crypt,talk.politics.misc
Subject: Re: PGP v. 2.1 Released
Date: 17 Dec 92 18:30:07 GMT
Organization: Oxford University Computing Services, 13 Banbury Rd Oxford OX2
	6NN
In-reply-to: boucher@csl.sri.com's message of 16 Dec 92 16:36:24 GMT


To whom it may concern  (principally UK readers, I presume) :

PGP v2.1 is now available for anon-ftp from black.ox.ac.uk (129.67.1.165)
in the /src/security directory.

Paul
--
Paul Leyland <pcl@oxford.ac.uk>          | Hanging on in quiet desperation is
Oxford University Computing Service      |     the English way.
13 Banbury Road, Oxford, OX2 6NN, UK     | The time is come, the song is over.
Tel: +44-865-273200  Fax: +44-865-273275 | Thought I'd something more to say.
Finger pcl@black.ox.ac.uk for PGP key    |
Newsgroups: alt.security
From: robert.heuman@rose.com (robert heuman)
Subject: Just a thought...
Organization: Rose Media Inc, Toronto, Ontario.
Date: Thu, 17 Dec 1992 03:30:25 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 12-16-92 22:19
This thread has been a discussion of encrypting hard drives.  There 
are several commercial products available to do this.  The only safe 
type is hardware (my view, of course) which uses KEKs (Key Encrypting 
Keys) which are stored on the encryption board and which can be backed 
up (encrypted of course) when generated or entered [on removable 
media]. Then if the encryption hardware fails, another board can be 
programmed with the same KEKs and the drive(s) still is accessable. 
These products also include access controls (UID and password) so that 
users can be controlled and identified as to permissions.  Of course, 
there is a cost....  The product costs $$$, and there is a small 
overhead while files are encrypted/decrypted.  And, of course, the 
good old Export Controls apply in both the US and Canada.

Anyway, it can be done now, if one wants to...

Robert Heuman
---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
Xref: sparky alt.security:5090 sci.crypt:5729 talk.politics.guns:25287 talk.politics.misc:64482 alt.security.pgp:202
From: mathew <mathew@mantis.co.uk>
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: Wed, 16 Dec 92 12:17:19 GMT
Distribution: world
Organization: Mantis Consultants, Cambridge. UK.

rlglende@netcom.com (Robert Lewis Glendenning) writes:
> If PGP is to become a world standard, given RSAREF, import/export
> restrictions, RIPEM, etc., then:
> 
> 1) Somebody in Europe needs to re-design PGP to use RSAREF, or an equivalent
> non-RSA algorithm.
[...]
> 2) Somebody in Europe needs to reverse engineer the RSAREF functionality.

Go to hell.  We've chosen PGP as the standard, and it's a perfectly good
standard.  If your country's stupid laws mean you can't use PGP, *you* can do
the hard work to get around those laws.


mathew
-- 
You can communicate with me securely via PGP 2.1.  For information, send mail
to pgpinfo@mantis.co.uk.  For a big block of keys, mail pgpkeys@mantis.co.uk.
PGP public key fingerprint = B2 41 30 5F 5B 20 B9 D5  7C 8F 75 88 7C DA D8 C5

Newsgroups: alt.security,sci.crypt,alt.security.pgp
From: gardner@convex.com (Steve Gardner)
Subject: Re: PGP v. 2.1 Released
Date: Tue, 15 Dec 1992 17:32:12 GMT
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1992Dec15.002332.10749@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>
>Uri Blumenthal, writing from watson.ibm, says he doesn't trust
>RSA at all, using a strong metaphor.
>
>Apparently his company disagrees, since they are a big customer
>for RSA's systems.
	I suppose you agree with every last jot and tittle of the policies
	of your organization huh?  Don't be silly.



						smg



Newsgroups: alt.security,sci.crypt
From: prz@sage.cgd.ucar.edu (Philip Zimmermann)
Subject: Zimmermann's answer to RSADSI PGP remarks
Organization: Climate and Global Dynamics Division/NCAR, Boulder, CO
Date: Fri, 18 Dec 1992 02:32:43 GMT


I would like to answer charges from Jim Bidzos of PKP/RSADSI that I
stole ideas from his public key encryption product, MailSafe.

In late 1986 Jim Bidzos demoed a copy of MailSafe and left it with
me, with no documentation.  I remember very little of that demo, and
never ran the program again after that day (because I lacked the
manual), and lost track of the program soon thereafter.  I haven't
seen it since.  I have no objection to giving credit to others for
their ideas, as anyone can see from reading the extensive
"Acknowledgements" section of the PGP manual.  Certainly if I had
gotten any significant ideas from MailSafe, I would have credited 
them in the PGP manual along with everyone else.  And I have not
even the slightest reason to lie about it, because I don't think
there is anything wrong with using "ideas" from other products.  But
I didn't get any ideas from MailSafe that were used in PGP.  All of
the ideas for PGP came from my own reading of the cryptography
literature, from talking with others, and from my own instincts as a
software engineer experienced in this art.  If you know cryptography
well, it seems obvious that these features are among those required
to implement a good product.  Indeed, some of the features described
by Bidzos that are common to MailSafe and PGP came as a surprise to
me when I recently read them in his remarks.  For example, I didn't
know MailSafe compressed the plaintext, checked itself for viruses,
and used ASCII encoding of the binary files. 

I applaud the recent eloquent remarks of Columbia Law School
Professor Eben Moglen on the legal issues of PGP.  People can 
certainly debate the complex legal issues.  But one thing is certain:
I did not steal any ideas from MailSafe in my design of PGP.

-Philip Zimmermann


Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: charlie@umnstat.stat.umn.edu (Charles Geyer)
Subject: Re: PGP as a World Standard
Organization: School of Statistics, University of Minnesota
Date: Fri, 18 Dec 1992 17:00:28 GMT

In article <1992Dec17.213627.28282@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>
>mathew argues as if PGP was some European invention we have a problem
>with in the U.S. That's a distortion of the real situation.
>
>Read my lips. PGP1.0 was contraband in the U.S., so much so that the
>author pulled out. It was illegally exported.  PGP2.0 was based on it.
>Thus the Europeans who use it don't have clean hands, regardless of
>the state of the law there.
>
>BEING DISHONEST WITH AN EXPLANATION ISN'T THE SAME AS BEING HONEST.

Don't tell me.  Let me guess.  You're not a lawyer, but you play one on
the net.  Am I right?

Do you seriously believe that a court outside the U. S. of A. would buy
that nonsense?

-- 
Charles Geyer
School of Statistics
University of Minnesota
charlie@umnstat.stat.umn.edu
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PGP as a World Standard
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 18 Dec 92 15:20:29 GMT

strnlght@netcom.com (David Sternlight) writes:

> These are all legalisms. The point i was making has to do with the
> notion of "clean hands." If one creates PGP1.0 in the U.S. as
> a violation of somebody's ownership/patent rights, it is 
> "contraband" (like that word better for those who quibble to
> make what is clearly unethical "right"?). The act of moving
> that item to another country where the patents don't apply
> (as distinct from programming from scratch in that country)
> doesn't alter the fact that the item is tainted. Using that
> code in the other country to create a later (2.0) version
> (as distinct from programming 2.0 de novo) doesn't change
> that the pro0duct is still tainted.

If you are speaking from the legal point of view, you must first
-prove- that PGP 2.0 is based on an illegally exported copy of PGP
1.0. I claim that it is not - it even cannot use the keyrings of PGP
1.0. It is a completely different product, developped independently
outside the USA, not exported illegally, and not based on any "stollen
goods". What is written in the docs simply doesn't matter; from the
legal point of view, you must -prove- your accusations.

Again, speaking about the legal point of view, there was a very nice
message from a law professor in sci.crypt, who clearly showed that all
those claims of PKP that they might sue the users of PGP are
completely bogus and anybody who is scared by them suffers of
paranoia...

> Clearer, now.

I hope.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: alt.security
From: bear@tigger.cs.Colorado.EDU (Bear Giles)
Subject: Re: I have a problem with a ATM transaction
Organization: National Oceanic & Atmospheric Adminstration / Boulder Labs
Date: Wed, 16 Dec 1992 03:13:22 GMT

In article <1992Dec8.083524.774@ualr.edu> lindstrom@acs.harding.edu writes:
>In article <Byuqwn.MF9@bcstec.ca.boeing.com>, silverm@bcstec.ca.boeing.com (Jeff Silverman) writes:
>>lindstrom@acs.harding.edu writes:
>>
>>>While I was in Texas, the rage was to 'borrow' a forklift and actually
>>>steal the ATM (load it in the back of you pickup, I guess).  For a
>>
>>Assuming for sake of discussion that you were evil and had larceny in your 
>>heart, wouldn't it be easier/safer/cheaper to simply rob the people as they
>>left the machines?
>>
>Sure.. that's what *I* would do :-).  But if you are able to swipe the
>machine and break into it, it will reward you with more $$$s than the
>average joe getting some cash.

The other thing is to consider what you will get hit with after (if) you
are caught.

Rob a bunch of ATM patrons (and remember, the "fast cash" is generally only
$40-50 which implies the average withdrawal is about the same) and you 
will get hit with numerous armed robbery charges.  In some states, a single
night can get you sent to prison FOR LIFE as a habitual criminal.

Steal an ATM machine and it's only property theft.  You'll get a lot more
money with a lot less criminal exposure.


Now, what I liked was the people who put an "out-of-order" sign on the
night-deposit box of a Denver bank, and then put this flimsy box in front
of it.  A number of people were actually dumb enough to put their deposits
in this freestanding box.

Somebody called the police and they arrested these rather creative people
when they returned to collect the loot.  WHAT WAS THE CRIME?  They put a
bogus "out-of-order" sign on the night-deposit box, but should they be
held accountable that other people were dumb enough to leave their deposits
in the other box?!

-- 
Bear Giles
bear@fsl.noaa.gov/cs.colorado.edu
Xref: sparky alt.security:5164 sci.crypt:5906
From: strnlght@netcom.com (David Sternlight)
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP v. 2.1 Released
Date: 18 Dec 92 21:45:46 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)


Arthur Rubin claims anyone from a U.S. site can get ripem from the
server. He is wrong. Not everything that can be found with archie
can be accessed or downloaded.

When ripem is released, one can be sure that the formal process
for getting a copy will be consistent with ITAR and the Munitions
Laws.

David
Xref: sparky alt.security:5109 sci.crypt:5786 talk.politics.guns:25356 talk.politics.misc:64651 alt.security.pgp:235
From: mathew <mathew@mantis.co.uk>
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: Thu, 17 Dec 92 15:18:47 GMT
Distribution: world
Organization: Mantis Consultants, Cambridge. UK.

Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu> writes:
> Thus said mathew <mathew@mantis.co.uk>:
> >Go to hell.  We've chosen PGP as the standard, and it's a perfectly good
> >standard.  If your country's stupid laws mean you can't use PGP, *you* can d
> >the hard work to get around those laws.
> 
> You've chosen PGP as the standard?  Don't you really mean you use PGP
> because it's the only thing that's widely available right now?  What
> other standards did you consider in this "choice"?

Well, I personally have two other public-key cryptosystems; one is for
MS-DOS, and in binary form only; the other has source code in Lisp.
I've never used either of them much, as they aren't anywhere near as
good as PGP.

> For that matter, do you mean you use PGP 1.0 as the standard, or PGP 2.0,
> or PGP 3.0 when it comes out... what is this "standard"?

A de facto market standard.  PGP 2.x.  Presumably when 3.x comes out,
that will become the standard.  Think of Turbo Pascal.


mathew
-- 
You can communicate with me securely via PGP 2.1.  For information, send mail
to pgpinfo@mantis.co.uk.  For a big block of keys, mail pgpkeys@mantis.co.uk.
PGP public key fingerprint = B2 41 30 5F 5B 20 B9 D5  7C 8F 75 88 7C DA D8 C5

Xref: sparky alt.security:5162 sci.crypt:5901
From: strnlght@netcom.com (David Sternlight)
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP as a World Standard
Date: 18 Dec 92 21:13:28 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)


Since Arthur Rubin, in his latest message, calls PKP's attempt
to protect their hard-won patent rights to their brilliant
invention (without which there'd be no PGP or ripem or
any other such system)  "persecution", it's obvious
that he's writing from a different ethical universe than
the one I live in, and any attempt to reason further with
him would be fruitless.

David
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp