From: markiel@callisto.pas.rochester.edu (Andrew Markiel)
Newsgroups: rec.games.netrek
Subject: Re: Where can I find crypt? (SOLUTION)
Date: 20 Nov 92 05:55:18 GMT
Organization: U(r) AstroTheory Group

In article <1992Nov18.222059.28514@ucsu.Colorado.EDU> farrow@ucsu.Colorado.EDU (J. Scott Farrow) writes:
>
>I talked via e-mail to Mike Polek <mcp@cs.UMD.EDU>, who is sending out the
>keys to the RSA clients. 
>
>He is willing to mail you the unencrypted client for your machine. He said
>that the source for crypt can't be posted or made available due to the 
>copyright and export limitations on the software that others have mentioned.
>
>I'm afraid Mike might get real busy if this catches on...
>
>Scott
>--
First of all, let me say that I don't want to seem ungrateful. The people
working on the new clients have put in a lot of time, without any personal
benefit, to get them ready, and I appreciate that. In fact, nothing would
ever get done without these volunteers. But, it seems like there's just a
problem here.

I don't have crypt, and judging from what people have said, I expect that
a lot of other people don't either, which means we'll have to get a client
mailed from Mike.
Now, next week, suppose someone puts RSA into the moo client (may have been
already done: I read all of r.g.n., and I haven't been able to keep up
on all the clients). Do I have to get someone to mail me a copy of that?
Suppose in a month, a new NBR client appears with some more features
added. Who will mail me a copy of that?

I don't think we can expect to distribute a new client every month, or
even every few months. Basically, I've been hoping to hear the magic words,
which are "this is the RSA NBR client, it has all the features we're
planning to put in, it's compiled for SunOS4.*, and it will work on any
server, this is the only client you'll need to get for the next year".
Is there any client out there which this can be said about? I'll understand
if the answer is no. But then, how long will it be till we can say this?
A month? A year? or never?

I'm thinking it might be better to keep things as they are until a final
NBR-RSA client is ready, and then do one single update. I think that this
would make things much easier for everyone. Is there any reason to begin
implementing RSA now? We've been tolerating the *possible* use of blessed
borgs for long enough that I don't think a few more months will hurt.

Finally, I have two questions about the RSA clients:

1) Supposedly, they aren't supposed to get in the hands of people who
aren't US or Canadian citizens. I assume a lot of people will be
maintaining one copy of the client for their group (as I am) which might
contain a foreign citizen. Do we have to chmod 700 the client to keep a
foreign citizen from getting access to the client? What about someplace
like CMU, which maintains a client for the whole undergraduate population?
Do they have to block access except to people who verify they are a US
citizen? Seems like this could be a lot of trouble.

2) Unless a way for foreign players is found to allow them to interface
with the RSA server (by some hack) I expect it will take less than a
month for some code to (accidently, of course) find it's way out of the
country. My question is, what will be done if it is found that
1) the crypt key
2) an RSA binary, or
3) the complete RSA code
has gotten out of the country? If the answer is "nothing", then I think
foreign players need not worry too much, as I have great faith in the
human capacity to get what people want.

-Grey Elf