From: bene@opal.cs.tu-berlin.de (Benedikt Homann)
Subject: Re: authentification in Emails
Organization: Technische Universitaet Berlin, Germany
Date: Sun, 6 Sep 1992 15:38:53 GMT

michael@galaga.stgt.sub.org (Michael Dreher) writes:
 |  In article <714782996snx@rabe.obb.sub.org> ralf@rabe.obb.sub.org (Ralf G. R. Bergs) writes:
 |  
 |  > Ich GLAUBE, das verwechselst Du was (oder etwa ich?  ;-))
 |  
 |  Ich bin mir nicht ganz sicher, aber soviel ich weiss meint die Firma,
 |  welche RSA anbietet, sie haette ein Copyright auf das Verfahren und
 |  das schliesst den Sourcecode ja wohl mit ein.
 |  
 |  > Ist es nicht vielmehr so, dass diese Verfahren nicht in Form von
 |  > Binaries aus den USA importiert werden duerfen, wohl aber in Form von
 |  > Algorithmen o. Source-Code?
 |  
 |  Wo gibt es denn ausserhalb der USA einen Sourcecode dafuer ???
 |  
 |  Falls jemand einen Source fuer RSA oder ein anderes gutes Public Key
 |  Verfahren hat, und dieser Source frei kopierbar ist, dann moege er
 |  sich bitte bei mir melden !
Wenn Du Zugang zu Anonymous Ftp hast: 
   ftp.fu-berlin.de:/incoming/public-key-encryption/unix_pgp10.tar.Z
Zum Thema Copyright ist vielleicht der folgende Auszug aus der
Dok zu pgp interessant:
 !
 !     PGPGUIDE.TXT            Thursday, April 30, 1992 7:43 am            Page 35
 !
 !
 !
 !
 !      
 !     Legal Issues
 !     ============
 !      
 !      
 !     Trademarks, Copyrights, and Warranties
 !     --------------------------------------
 !      
 !     "Pretty Good Privacy", "Phil's Pretty Good Software", and the "Pretty
 !     Good" label for computer software and hardware products are all
 !     trademarks of Philip Zimmermann and Phil's Pretty Good Software.  PGP
 !     is (c) Copyright Philip R. Zimmermann, 1990.  
 !      
 !     The author assumes no liability for damages resulting from the use of
 !     this software, even if the damage results from defects in this
 !     software, and makes no representations concerning the merchantability
 !     of this software or its suitability for any specific purpose.  It is
 !     provided "as is" without express or implied warranty of any kind.
 !      
 !      
 !     Patent Rights on the Algorithms
 !     -------------------------------
 !      
 !     When I first released PGP, I half-expected to encounter some form of
 !     legal harrassment from the Government.  Indeed, there has been legal 
 !     harrassment, but it hasn't come from the Government-- it has come
 !     from a private corporation.
 !      
 !     The RSA public key cryptosystem was developed at MIT with Federal
 !     funding from grants from the National Science Foundation and the
 !     Navy.  It is patented by MIT (U.S. patent #4,405,829, issued 20 Sep
 !     1983).  A company in California called Public Key Partners (PKP) holds
 !     the exclusive commercial license to sell and sub-license the RSA
 !     public key cryptosystem.  The author of this software implementation
 !     of the RSA algorithm is providing this implementation for educational
 !     use only.  Licensing this algorithm from PKP is the responsibility of
 !     you, the user, not Philip Zimmermann, the author of this software
 !     implementation.  The author assumes no liability for any patent
 !     infringement that may result from the unlicensed use by the user of
 !     the underlying RSA algorithm used in this software.  Foreign users
 !     should note that the RSA patent does not apply outside the US, and
 !     there is no RSA patent in any other country.  Federal agencies may
 !     use it because the Government paid for the development of RSA.  
 !      
 !     Unfortunately, PKP is not offering any licensing of their RSA patent
 !     to end users of PGP.  This essentially makes PGP contraband in the
 !     USA.  Jim Bidzos, president of PKP, has threatened to take legal
 !     action against me unless I stop distributing PGP, until they can
 !     devise a licensing scheme for it.  I agreed to this, since PGP is
 !     already in wide circulation and waiting a while for a licensing
 !     arrangement from PKP seemed reasonable.  Mr. Bidzos assured me (he
 !     even used the word "promise") several times since the initial 5 June
 !     91 release of PGP that they were working on a licensing scheme for
 !     PGP.  Apparently, my release of PGP provided the impetus for them to
 !     offer some sort of a freeware-style license for noncommercial use of
 !     the RSA algorithm.  However, in December 1991 Mr. Bidzos said he had
 !
 !
 !     PGPGUIDE.TXT            Thursday, April 30, 1992 7:43 am            Page 36
 !
 !
 !
 !
 !     no plans to ever license the RSA algorithm to PGP users.  He denies
 !     ever implying that he would.  Meanwhile, I have continued to refrain
 !     from distributing PGP.
 !      
 !     I wrote my PGP software from scratch, with my own implementation of
 !     the RSA algorithm.  I didn't steal any software from PKP.  Before
 !     publishing PGP, I got a formal written legal opinion from a patent
 !     attorney with extensive experience in software patents.  I'm
 !     convinced that publishing PGP the way I did does not violate patent
 !     law.  However, it is a well known axiom in the US legal system that
 !     regardless of the law, he with the most money and lawyers prevails, 
 !     if not by actually winning then by crushing the little guy with legal
 !     expenses.  
 !      
 !     Not only did PKP acquire the exclusive patent rights for the RSA
 !     cryptosystem, which was developed with your tax dollars, but they 
 !     also somehow acquired the exclusive rights to three other patents
 !     covering rival public key schemes invented by others, also developed
 !     with your tax dollars.  This essentially gives one company a legal
 !     lock in the USA on nearly all practical public key cryptosystems. 
 !     They even appear to be claiming patent rights on the very concept of
 !     public key cryptography, regardless of what clever new original
 !     algorithms are independently invented by others.  And you thought
 !     patent law was designed to encourage innovation!  PKP does not
 !     actually develop any software-- they don't even have an engineering
 !     department-- they are essentially a litigation company.  
 !      
 !     Public key cryptography is destined to become a crucial technology in
 !     the protection of our civil liberties and privacy in our increasingly
 !     connected society.  Why should the Government try to limit access to 
 !     this key technology, when a single monopoly can do it for them?  
 !      
 !     It appears certain that there will be future releases of PGP,
 !     regardless of the outcome of licensing problems with Public Key
 !     Partners.  If PKP does not license PGP, then future releases of PGP
 !     might not come from me.  There are countless fans of PGP outside the
 !     US, and many of them are software engineers who want to improve PGP
 !     and promote it, regardless of what I want to do.  I am told by many
 !     foreign users that if it seems necessary to them, future releases of
 !     PGP will come from outside the US, out of reach of US patent laws,
 !     and there's nothing I can do to stop it.
 !      
 !     The LZHuf compression routines in PGP come from public domain source
 !     code.  I'm not aware of any patents on the LZHuf algorithm, but I've
 !     heard that a related compression algorithm, LZW, has some patent
 !     claims from Unisys Corporation.  LZHuf is different from LZW, and
 !     might not be affected by this patent.  If you're interested, you're
 !     welcome to look into this murky issue yourself.  If there are any
 !     patent claims that apply to LZHuf, then sorry, you'll have to take
 !     care of the patent licensing, not me.
 !      
 !     All this patent stuff reminds me of a Peanuts cartoon I saw in the
 !     newspaper where Lucy showed Charlie Brown a fallen autumn leaf and
 !     said "This is the first leaf to fall this year."  Charlie Brown said,
 !     "How do you know that?  Leaves have been falling for weeks."  Lucy
 !     replied, "I had this one notarized."
 !
 !
 !     PGPGUIDE.TXT            Thursday, April 30, 1992 7:43 am            Page 37
 !
 !
 !
 !
 !      
 !      
 !     Licensing and Distribution
 !     --------------------------
 !      
 !     In the USA PKP controls, through US patent law, the licensing of the
 !     RSA algorithm.  But I have no objection to anyone freely using or
 !     distributing my PGP software, without payment of fees to me (except
 !     as provided below).  You must keep the copyright notices on PGP and
 !     keep this documentation with it.  However, if you live in the USA,
 !     this may not satisfy any legal obligations you may have to PKP for
 !     using the RSA algorithm as mentioned above.  
 !      
 !     In fact, if you live in the USA, and you are not a Federal agency, 
 !     you shouldn't actually run PGP on your computer, because Public Key
 !     Partners wants to forbid you from running my software.  PGP is
 !     contraband.  
 !      
 !     Of course, I can't give any assurances, but my guess is that it seems
 !     unlikely that PKP would waste their time pursuing PGP end users for
 !     patent infringement.  There are just too many PGP users to go after. 
 !     And why would they single you out?  But I certainly wouldn't want to
 !     imply that you do anything improper-- if PKP were offering licenses,
 !     I would urge you to obtain one.  But since they aren't, well, I guess
 !     you should just refrain from using PGP if you live in the USA.  
 !      
 !|    PGP is not shareware, it's freeware.  Forbidden freeware.  Published
 !|    as a community service.  If I sold PGP for money, then I would get
 !|    sued by PKP for using their RSA algorithm.  More importantly, giving
 !|    PGP away for free will encourage far more people to use it, which
 !|    hopefully will have a greater social impact.  This could lead to
 !|    widespread awareness and use of the RSA public key cryptosystem,
 !|    which will probably make more money for PKP in the long run.  If only
 !|    they could see that.  
 !      
 !     All the source code for PGP is available for free under the "Copyleft" 
 !     General Public License from the Free Software Foundation (FSF).  A
 !     copy of the FSF General Public License is included in the source
 !     release package of PGP.
 !      
 !     Regardless of and perhaps contrary to some provisions of the FSF
 !     General Public License, the following terms apply:
 !      
 !     1)  Written discussions of PGP in magazines or books may include
 !         fragments of PGP source code and documentation, without 
 !         restrictions.
 !      
 !     2)  If somehow PKP ever licenses their patent to PGP users for a fee,
 !         and you are able and willing to pay PKP a license fee for the RSA 
 !         algorithm, then I guess that sort of makes PGP not exactly free, 
 !         doesn't it?  If you decide to do that, then I'm asking for a
 !         matching donation (or $50, whichever is less) from each end user 
 !         that pays PKP a license fee.  
 !      
 !     3)  Although the FSF General Public License allows non-proprietary
 !         derivative products, it prohibits proprietary derivative products. 
 !
 !
 !     PGPGUIDE.TXT            Thursday, April 30, 1992 7:43 am            Page 38
 !
 !
 !
 !
 !         Despite this, I may grant you a special license if you want to 
 !         derive a proprietary commercial product from some of PGP's parts.  
 !         There may or may not be a fee depending on what kind of a deal you 
 !         plan to pursue with PKP.  Retaining my copyright notice and 
 !         attribution might suffice in some cases.  Give me a call and we'll 
 !         discuss it.  I'm real easy to please.
 !      
 !     Feel free to disseminate the complete PGP release package as widely
 !     as possible.  Give it to all your friends.  If you have access to any
 !     electronic Bulletin Boards Systems, please upload the complete PGP
 !     executable object release package to as many BBS's as possible.  You
 !     may disseminate the PGP source release package too, if you've got
 !     it.  The PGP version 1.0 executable object release package for MSDOS
 !     contains the PGP executable software, documentation, sample keyrings
 !     including my own public key, and signatures for the software and this
 !     manual, all in one PKZIP compressed file called PGP10.ZIP.  The PGP
 !     source release package for MSDOS contains all the C source files in
 !     one PKZIP compressed file called PGP10SRC.ZIP.
 !      
 !     You may obtain free copies or updates to PGP from thousands of BBS's
 !     worldwide or from other public sources such as Internet FTP sites. 
 !     Don't ask me for a copy directly from me, since I'd rather avoid
 !     further legal problems with PKP at this time.  I might be able to
 !     tell you where you can get it, however.  
 !      
 !     After all this work I have to admit I wouldn't mind getting some fan
 !     mail for PGP, to gauge its popularity.  Let me know what you think
 !     about it and how many of your friends use it.  Bug reports and
 !     suggestions for enhancing PGP are welcome, too.  Perhaps a future PGP
 !     release will reflect your suggestions.  
 !      
 !     This project has not been funded and the project has nearly eaten me
 !     alive.  This means you can't count on a reply to your mail, unless
 !     you only need a short written reply and you include a stamped
 !     self-addressed envelope.  But I do reply to E-mail.  Please keep it in
 !     English, as my foreign language skills are weak.  If you call and I'm
 !     not in, it's best to just try again later.  I usually don't return
 !     long distance phone calls, unless you leave a message that I can call
 !     you collect.  If you need any significant amount of my time, I am
 !     available on a paid consulting basis, and I do return those calls.
 !      
 !     The most inconvenient mail I get is for some well-intentioned person
 !     to send me a few dollars asking me for a copy of PGP.  I can't send
 !     it to them because of the legal threats from PKP (or worse--
 !     sometimes these requests are from foreign countries, and I would be
 !     risking violating cryptographic export control laws).  Even if there
 !     were no legal hassles involved in sending PGP to them, they usually
 !     don't send enough money to make it worth my time, because I'm just
 !     not set up as a low cost low volume mail order business.  I can't just
 !     ignore the request and keep the money, because they probably regard
 !     the money as a fee for me to fulfill their request.  If I return the
 !     money, I might have to get in my car and drive down to the post
 !     office and buy some postage stamps, because these requests rarely
 !     include a stamped self-addressed envelope.  And I have to take the
 !     time to write a polite reply that I can't do it.  If I postpone the
 !     reply and set the letter down on my desk, it might be buried within
 !
 !
 !     PGPGUIDE.TXT            Thursday, April 30, 1992 7:43 am            Page 39
 !
 !
 !
 !
 !     minutes and won't see the light of day again for months.  Multiply
 !     these minor inconveniences by the number of requests I get, and you
 !     can see the problem.  It would be nicer if people could try to get
 !     PGP from any of the myriad other sources.  If you can't find it
 !     yourself, I don't mind answering a quick phone call. 
 !      
 !     If anyone wants to volunteer to improve PGP, please let me know.  It
 !     could certainly use some more work.  Some features were deferred to
 !     get it out the door.  A number of PGP users have since donated their
 !     time to port PGP to Unix on Sun SPARCstations, to Ultrix, to VAX/VMS,
 !     to OS/2, to the Amiga, and to the Atari ST.  Perhaps you can help
 !     port it to some new environments, such as the Apple Macintosh, MS
 !     Windows, X windows, or XVT.  But please let me know if you plan to
 !     port PGP, to avoid duplication of effort, and to avoid starting with
 !     an obsolete version of the source code.  
 !      
 !     This is the first release of PGP.  Future versions of PGP may have to
 !     change the data formats for messages, signatures, keys and key rings,
 !     in order to provide important new features.  This may cause backward
 !     compatibility problems with this version of PGP.  Future releases may
 !     provide conversion utilities to convert old keys if this is practical,
 !     but you may have to generate new keys and dispose of old messages
 !     created with the old PGP.  Such a conversion effort hopefully will
 !     have to be done only once, if at all.
 !      
Ueber die Qualitaet der generierten Schluesselpaare kann ich nichts sagen. 
Bei anderen Paketen waren die Schluessel nach meinen Informationen zu kurz.

Gruesse,
   Benedikt.
Newsgroups: de.comm.misc