HDTenEightyP/NetNews huggingface dataset:
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP use Ethical and Legal Questions
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Wed, 23 Dec 1992 21:02:02 GMT


Rick Miller makes a couple of legal arguments, that I, as a fellow
non-attorney, think incorrect.

1. He asserts that until a patent is tested in court its status
is indeterminate. I think this is a misstatement of law. I believe
the law is that until a patent is overthrown in court it is valid.
That's a very different matter, and leads to such things as
retrospective damages from the time of the verdict.

2. He seems to make an argument that the RSAREF license, in effect,
puts RSA for non-commercial use in the public domain. It does not.
What it does is permit the use of RSAREF by those to whom RSA
gives the license. Again, legally that's quite a different matter
and as I understand it, in no way reduces RSA/PKP's rights.

By the way, has no one noticed that in the license RSA agrees to
defend any licensee against any lawsuits for patent violation
(for use of unmodified RSAREF) without limit. That, and much else
in the license agreement, seems to me to put paid to the various
nasty inferences made by some (I'm speaking generally, not
particularly about Miller) here about RSA's motives, particularly
since the license is free.

It seems to me that RSA is bending over backwards to make the
stuff available for non-commercial use, while acting as any
reasonable person would to protect their patent and property
rights.

I understand from Jim Bidzos that they're going to go even further.
As soon as they get their administrative act together, those who
request RSAREF directly from RSA (U.S. and Canadians only, I suppose)
will also get anything that uses RSAREF as well, such as RIPEM and
other goodies.

David
-- 
David Sternlight
RIPEM key on server
Newsgroups: sci.crypt,misc.legal
From: tenney@netcom.com (Glenn S. Tenney)
Subject: Re: PGP use Ethical and Legal Questions
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 25 Dec 1992 06:46:48 GMT

In article <1h9hnlINN5vm@uwm.edu> rick@ee.uwm.edu (Rick Miller) writes:
> ...
>This same thing confronts *anyone* who contracts labor of just about any sort.
>What about RSA/PKP?  They've undoubtedly known of PGP 2.1, yet have not taken
>any action (that I know of) to defend their patent... this signifies approval
>by default in my eyes.  The only objection they seem to have (according to the
>RSAREF license) is that PGP doesn't use the software libraries written by RSA.

Nice for a fairy tale, but we're talking about Federal patent law, 
not contract law.  You might want it to be this way, but...

> ...
>Essentially, RSA's RSAREF license says, "Because this is our proprietary
>algorithm, we're going to dictate that you only implement it with our source-
>code."   The RSAREF license forbids any changes (other than those needed to
>port it, in C only, to other architectures).  This means that you're not even
>allowed to *improve* it!  I'm sure that someone could find a way to run their
>algorithm more efficiently, quicker, etc. ... but that's not allowed.

When someone purchase a Xerox copier, they are not buying a license to
do what they want with the patented technology.  Yes, they own
the box and can modify or sell it to their heart's content, but
they are not being given the right to build infringing products
just because they have the right to own one.

The patent owner can choose how they license it.  RSA *has* licensed
it to many companies, and still offers commercial licenses.  Go back
to my comments about Xerox...  If you wanted to buy a kit to make
your own infringing copier 20 years ago, Xerox wouldn't accept a
license with you either.

There are some valid business reasons I can imagine why RSA wouldn't
want the RSAREF interface to be changed -- there's much advantage to
a signle standardized interface.  But *you* can, based on my reading
of the new license, improve it's efficiency.  I'm waiting for
someone to ask for permission to do other things with it and
see what RSA says.  I'll hold off comments until then -- everyone
might be surprised if RSA says 'yes' to people wanting to change
things...


-- 
Glenn Tenney
voice: (415) 574-3420      fax: (415) 574-0546
tenney@netcom.com          Ham radio: AA6ER
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: PKP patents (legal question)
Organization: Chinet - Public Access UNIX
Date: Thu, 24 Dec 1992 16:03:18 GMT

In article <168C761F.UC445585@mizzou1.missouri.edu> UC445585@mizzou1.missouri.edu (John M. Kelsey) writes:
>   Does PKP hold patents to *all* forms of public-key cryptology, including
>those methods still undiscovered?  Or do they simply hold the patent to
>all public key methods currently known?  Or neither?


PKP claims that patent 4,218,582 covers the very concept of public-key
cryptography, and hence applies to all methods discovered and undiscovered.
Many disupte this claim, although it has never been tested in the courts.

Want to be a test case?

Bruce
Newsgroups: sci.crypt,misc.legal
From: smb@research.att.com (Steven Bellovin)
Subject: Re: PGP use Ethical and Legal Questions
Date: Thu, 24 Dec 1992 01:55:17 GMT
Organization: AT&T Bell Laboratories

In article <bontchev.725149117@fbihh>, bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
> strnlght@netcom.com (David Sternlight) writes:
> 
> > By the way, has no one noticed that in the license RSA agrees to
> > defend any licensee against any lawsuits for patent violation
> > (for use of unmodified RSAREF) without limit. That, and much else
> > in the license agreement, seems to me to put paid to the various
> > nasty inferences made by some (I'm speaking generally, not
> > particularly about Miller) here about RSA's motives, particularly
> > since the license is free.
> 
> How generous from their part, isn't it? Now, who the hell could be
> those bad guys who will be going to sue you for usage of RSAREF?...

You're reading too much into the change.  The ``hold harmless''
language is fairly conventional in such situations.  I've seen it in
many different contracts.  It's not to guard against a specific, known
contingency; rather, it's to guard against unknown ones.  In this case,
RSADSI is distributing some software covered by a PKP patent.  Does
RSADSI have the right to do so?  A cautious attorney would demand
letters from PKP verifying that RSADSI has that right, and letters from
MIT and Stanford -- the patent holders -- verifying that they've given
PKP the right to grant sublicenses.  After all, how do we *know* that
PKP really has that right?  Their corporate name isn't on any of the
patents.

The hold harmless clause is RSADSI's way of saying that they're very
confident that you don't have to worry.  Not that there's any real
doubt about RSADSI's rights here -- but there have been enough
allegations of improper behavior that adding the clause is cheap
insurance.
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
From: positron@quip.eecs.umich.edu (Jonathan Haas)
Subject: Re: Risks of Using PGP 2.0
Organization: University of Michigan EECS Dept., Ann Arbor
Date: Sun, 3 Jan 1993 15:39:41 GMT

In article <books.149.0@fsunuc.physics.fsu.edu> books@fsunuc.physics.fsu.edu (Roger Books) writes:
>In article <1992Dec7.022454.25486@eff.org> mnemonic@eff.org (Mike Godwin) writes:
>>In article <1992Dec6.195840.26035@mtu.edu> cescript@mtu.edu (Charles 
>Scripter) writes:>
>>>I don't believe the "Commerce Clause" was intended to give the feds the
>>>magnitude of power that they have taken under this clause.  They have
>>>merely usurped the power from the States...
>>
>>Not as far as drug laws go. The states still have plenty of power to pass
>>their own drug laws.
>>
>>
>>--Mike
>>
>
>But do they have the power to legalize drugs?  They should have that by
>the Constitution.
>

For awhile, here in Ann Arbor the fine for using marijuana was $5...
effectively legalizing it. Unfortunately, the City Council recently
voted to raise that to a more "appropriate" amount :-(.

-- 
__/\__  Jonathan S. Haas         | Jake liked his women the way he liked
\    /  University of Michigan   | his kiwi fruit: sweet yet tart, firm-
/_  _\  positron@eecs.umich.edu  | fleshed yet yielding to the touch, and
  \/                             | covered with short brown fuzzy hair.
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: sci.crypt.research
Organization: Chinet - Public Access UNIX
Date: Sat, 26 Dec 1992 17:30:43 GMT

In article <1992Dec26.130926.8025@infodev.cam.ac.uk> rja14@cl.cam.ac.uk (Ross Anderson) writes:
>In <Bzru3E.1I4@chinet.chi.il.us> schneier@chinet.chi.il.us (Bruce Schneier) 
>
>However, in the interests of naming consistency, we should probably keep 
>sci.crypt for the hobbyists and create a new group called sci.crypt.research 
>for academic researchers. 
>
>Look at sci.math and sci.math.research; the partition works pretty well.

I second this motion.

Bruce
Newsgroups: sci.crypt,alt.society.civil-liberty
From: positron@quip.eecs.umich.edu (Jonathan Haas)
Subject: Question from someone who's new to all this
Organization: University of Michigan EECS Dept., Ann Arbor
Date: Sun, 3 Jan 1993 17:04:53 GMT

Question:

How can someone (PKP) patent a mathematical algorithm?
Has this patent yet been challenged in court? It seems
to me that it would be like trying to patent the Pythagorean
Theorem.

-- 
__/\__  Jonathan S. Haas         | Jake liked his women the way he liked
\    /  University of Michigan   | his kiwi fruit: sweet yet tart, firm-
/_  _\  positron@eecs.umich.edu  | fleshed yet yielding to the touch, and
  \/                             | covered with short brown fuzzy hair.
Newsgroups: sci.crypt
From: erc@unislc.uucp (Ed Carp)
Subject: Re: PKP/RSA comments on PGP legality
X-Newsreader: TIN [version 1.1 PL6]
Organization: Unisys Corporation SLC
Date: Tue, 29 Dec 1992 00:32:05 GMT

David Sternlight (strnlght@netcom.com) wrote:

: Second, something doesn't become public domain simply because it's
: published. Instead of asserting, I suggest Rubin post the specific
: language of the law about 'public domain' as I have about software.

It is not only "the law" as originally written that must be taken into
consideration here, but also court rulings (which have the effect of
interpreting the law and sometimes even changing radically the original intent)
that have even the slightest bearing on the issue.  While it is true that
publishing something doesn't automatically make it public domain, in some
cases it may seriously weaken any claims of patent infringement.  Not all,
of course, otherwise nothing would ever be published.  :)

On proprietary non-disclosed material, the restrictions on disclosure must be
fairly exacting, else one loses the protection afforded by declaring
something a "trade secret".  Consider the Datapoint case of several years
back.  Two programmers who had worked for Datapoint walked out with listings
of Datapoint DOS, rekeyed it, then sold it.  The courts said that because
Datapoint hadn't taken steps to protect their copyrighted material (like
restricting access to listings and source code) they lost the protections
afforded herein.

I wasn't there at the time, but was told this by a Datapoint corporate
attorney.
-- 
Ed Carp			erc@apple.com, erc@saturn.upl.com	801/538-0177

Who and what would you be if you went beyond your deepest fears?
From: karn@servo.qualcomm.com (Phil Karn)
Newsgroups: sci.crypt
Subject: Re: PGP - Legal?
Date: 4 Jan 93 04:17:14 GMT
Organization: Qualcomm, Inc

In article <1993Jan4.030425.7578@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>We were talking about what's possible. Phil should read the munitions
>act some day.

I have, at length. (Well, actually the ITARs, which are authorized by
the Munitions Act).  I have also consulted an attorney who specializes
in export control issues.  The rules are, at best, deeply ambiguous
when it comes to freely available public domain software. However,
chances are also very good that any attempt to apply them to such a
case would be tossed out of court. (Why do you think that no such case
has ever been brought?)

The ITAR writers clearly never envisioned that software would be
freely given away. The assumption was that software, especially source
code, would be proprietary. Like the detailed plans to, say, the
avionics of an F-15, which are not available at my local Comp USA
store or by anonymous FTP over the net. But crypto software *is*
freely available from these places, and from quite a few worldwide
publications (a list of which I posted here recently).

Perhaps David Sternlight should read the First Amendment to the
Constitution of the United States some day.

>Phil seems to think that calling attention to the facts makes one
>a right-wing Republican. He is way off base.

Perhaps I am. The polical spectrum goes much further than "right-wing
Republican"...

Phil
Xref: sparky sci.crypt:6230 news.admin:8776 news.groups:24936
From: alizard@tweekco.uucp (A.Lizard)
Newsgroups: sci.crypt,news.admin,news.groups
Subject: Re: (redirected) sci.crypt.research
Date: Mon, 28 Dec 92 02:55:25 PST
Organization: Tweek-Com Systems BBS, Moraga, CA (510) 631-0615

alain@elevia.uniforum.qc.ca (W. A. Simon) writes:

> PLEASE NOTE THE FOLLOWUP-TO HEADER
> 
> In <9212272117.AA16102@NMSU.Edu>
> ted@nmsu.edu
> disagrees with my previous (hasty) piece:
> 
> >> [ ... ]
> >> NO 	to sci.crypt.research
> >> YES	to talk.crypt
> >> YES	to keeping sci.crypt as is
> >> NO	to moderating either
> 
> > this is all well and good, but creating a new group has the advantage
> > of leaving all the talkers behind.  since they won't hear the fact
> > that there is a new place to blather, they will continue to pollute
> > the group.
> > it might work if there were a moderator who forwarded all talk posts
> > to talk.crypt

A moderated mailing list might be more appropriate for specialized
cryptographers... (in which case, a CFV for a new newsgroup might be
superfluous) Are there enough people capable of doing actual crytpo
work to provide sufficient traffic for a sci.crypt.research
newsgroup?

I have no strong interest either way, my interest is as a user,
not as a person capable of writing bulletproof cryptographic algorithms
or software, I'm merely interested in using a reliable product.
A.Lizard

-------------------------------------------------------------------
A.Lizard Internet Addresses:
alizard%tweekco%boo@PacBell.COM        (preferred)
[path]!pacbell.COM!boo!tweekco!alizard (bang path for above)
alizard@seer.mystic.com (backup)   alizard@Blue.Kludge.com (backup)
PGP2.0 public key available on request.
Newsgroups: sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: Privacy -- encrypt/decrypt devices on Wireless phones
Organization: Qualcomm, Inc
Date: Tue, 29 Dec 1992 20:56:56 GMT

In article <1992Dec29.183101.4176@mnemosyne.cs.du.edu> rwirthli@nyx.cs.du.edu (Ralph Wirthlin) writes:
>Although "secure" wireless phones may exist, it would be impossible
>for the general public to obtain one.  Strictly speaking, a "secure" device
>would allow discussion or dissemination of classified material
>over a non-secure link (i.e. phone lines, air waves) and thus
>would be unavailable to the public. 

Well, if by "secure" you mean "authorized for the protection of
classified information", you're right. The government only authorizes
NSA's (secret) algorithms for this purpose. But properly used, even
publicly available ciphers like RSA and DES could still provide a very
high degree of protection. Perhaps even against the NSA.

>It may not be right, but it certainly is legal as long as the contents
>of that conversation are not disclosed.  Cellular conversations are 
>"protected" from eavesdropping thanks to the fine folks on capitol hill.

It's worse than that. Cordless phones are not protected *at all*. This
has been upheld in two court cases (Rhode Island and Kansas, I think)
where a neighbor overheard a cordless phone user discuss drug dealing
or other illegal activities and reported it to the police. The police
then used the information against the suspect without a warrant. The
courts ruled that there was no "expectation of privacy" on a cordless
phone, so the evidence was admissible.

On the other hand, you're right that cellular conversations require a
warrant despite their using the exact same modulation method (FM) and
considerably more RF power than a cordless phone. It is theorized that
this state of affairs has something to do with there being a powerful
domestic cellular industry in the US, but no corresponding domestic
industry for cordless phones.

Phil
Xref: sparky sci.crypt:6334 comp.compression:4301 comp.compression.research:352
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 25 Dec 1992 18:25:10 GMT

In article <1992Dec25.172233.1663@cbnews.cb.att.com>
jap@cbnews.cb.att.com (james.a.parker) writes, in a discussion about
importing patented materials without permission:

>If the "process" is encryption of plaintext by a public key, then wouldn't
>the "product made by the process" be: 
> 
> o The public/private key pair, and 
> o Text encrypted by the public key

Whether that interpretation is correct or not with respect to the keys
or signature, both the U.S. Govrnment under the Munitions Act, and RSA
under their patent have made RSA encryption for signature validation
and message authentication freely available and exportable. Thus keys
and signatures may be freely passed around (note this, Vesselin
Bontchev, with respect to my PGP key being around outside the U.S..)

Encrypted text may not, since no permission has been given.

Thus, with the above clarifications, what appears to be illegal, or a
patent violation (pick the appropriate one) is importing of PGP to the
U.S. without both a Goverment license and an agreement from the patent
holders, and import or export to or from the U.S. of encrypted text
(but not signatures or message authentications or keys for that
purpose) using PGP without permission of patent holders.

This raises an interesting notion, which I haven't the interest to
look into, but some of the more committed PGP fans may wish to.
Would a version of PGP which does authentication and message digests
only be o.k. to import and use in the U.S.? I don't know, but if it
were, that might provide some partial compatibility. Anyone for a
quick piece of crippleware?

On the other hand, I understand there is an exportable system for
such purposes being prepared under the RFCs, and it is likely
to become the international standard when it's ready. I don't know
what the status of that is but would like to. Anyone?

If that system is anywhere close to release, then please disregard
my suggestion of a version of PGP for that purpose.

David

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: Owen.Lewis@purplet.demon.co.uk (Owen Lewis)
Subject: Re: Word Perfect Cracker
Organization: FidoNet node 2:252/305.0 - The Purple Tentacle, Reading
Date: Wed, 23 Dec 1992 03:48:00 +0000

 -=> Quoting Ron Dippold to All <=-

 RD> I've already released the source code for my Word Perfect password
 RD> cracker / decrypter to the public domain, but it's hard to find, and
 RD> I've had lots of email requests, so I figured I'd just post it here.
 RD> Is that appropriate, or should I use one of the sources groups?

 Personally, I'd be apperiate seeing it here, Ron. 
 
 Regards,

 Owen Lewis



___ Blue Wave/QWK v2.11

Newsgroups: sci.crypt,comp.binaries.ibm.pc.d
From: rwirthli@nyx.cs.du.edu (Ralph Wirthlin)
Subject: ARJ encryption
Organization: Nyx, Public Access Unix @ U. of Denver Math/CS dept.
Date: Mon, 28 Dec 92 21:17:03 GMT

	I was wondering if anyone knows the algorithm used in arj for
the encryption scheme.  It appears to XOR the compressed text with some
permutation of the password string (I suspect this is XOR'd with something
else as well).  If anyone knows, please email and I'll summarize, otherwise
I'll just figure it out myself.


                      			Thanks,

					Ralph

Newsgroups: sci.crypt
From: rwirthli@nyx.cs.du.edu (Ralph Wirthlin)
Subject: Re: Privacy -- encrypt/decrypt devices on Wireless phones
Organization: University of Denver, Dept. of Math & Comp. Sci.
Date: Tue, 29 Dec 92 18:31:01 GMT

bz223@cleveland.Freenet.Edu (Danny Guy Frezza) writes:


>	I would like to ask, specifically, if anyone has information 
>concerning encrypting/decrypting wireless phones?  Someone mentioned in a
>recent post that Motorola has such a thing, but, how about AT&T or other
>big giants? 
>Do they have any wireless phones that are "secure" or are 
>there any plans for it, on a wide-scale basis? 

Although "secure" wireless phones may exist, it would be impossible
for the general public to obtain one.  Strictly speaking, a "secure" device
would allow discussion or dissemination of classified material
over a non-secure link (i.e. phone lines, air waves) and thus
would be unavailable to the public. 
  As far as Motorola's offering, I suspect it doesn't use anything that
the NSA can't crack.  It may just turn speach into digital pulses that
can be reassembled at the receiving end.     
   

>[son listening] to wireless phone conversations, I became annonyed and
>explained to him that it was not right to listen in on private
>conversations. I beccame quite upset, knowing the potential of this problem. 

It may not be right, but it certainly is legal as long as the contents
of that conversation are not disclosed.  Cellular conversations are 
"protected" from eavesdropping thanks to the fine folks on capitol hill.
But that doesn't mean anyone with a scanner or even an old TV which
covered UHF channels up to 83 can't listen in.

>I see no reason why
>for example, a base unit and a handheld cordless phone, cannot have at 
>least the same privacy as a wired line.  For this reason, I am asking this
>question as a serious one.  I surely would not like someone eavesdropping
>on my conversations.  I know that the choice was mine, but did not realized
>how simple it was to intercept a wirless conversation.  If there are no
>specific wirless base-handheld phones that employ sophisicated privacy
>features, are there any devices that can be added to existing wirless
>phones?  Thanks.
>-- 

I agree with you, there *should* be devices available which would allow
a reasonable amount of privacy.  Law enforcement and
spy-catching would be hampered, however, if such devices were available to the
general public.  What's interesting though, is that the *real* spies
and criminals probably already use such devices.  They're not that hard
to build (at least I wouldn't think so).  Get a couple of A-D converters,
maybe a DES chip, and you're all set, more or less ( I don't know, I've
never built one).
  This lack of privacy is precisely why I *won't* purchase a cordless
phone.