NetNews Usenet Archive 1992 #30/NN_1992_30.iso/spool/sci/crypt/5717

Internet Message Format | 1992-12-15 | 5.4 KB

Path: sparky!uunet!spool.mu.edu!olivea!genie!udel!intercon!usenet
From: [e-mail] (Amanda Walker)
Newsgroups: sci.crypt
Subject: Re: PKP/RSA comments on PGP legality
Message-ID: <[e-mail]>
Date: 15 Dec 92 23:45:31 GMT
References: <[e-mail]>
Reply-To: [e-mail] (Amanda Walker)
Organization: InterCon Systems Corporation
Lines: 110
NNTP-Posting-Host: chaos.intercon.com
X-Newsreader: InterCon TCP/Connect II 1.1b23

[e-mail] (Hugh Miller) writes:
>     Mr. Bidzos gives the appearance of being a very effective lawyer,
> representing the interests of his company, RSADSI/PKP, well.

Indeed.  Not surprising, though.

>     Mr. Bidzos claims that we should avoid using PGP because it is
> "tainted by serious ITAR violations."  If it has fallen to the likes of
> Mr. Bidzos to prosecute PGP developers, distributors, and users under
> the ITAR, then the Reagan Revolution's privatization-of-government
> schemes have gone farther than we thought.

Warning someone that they are doing something potentially dangerous is not
equivalent to "prosecution," as you so glibly pretend here.  Just the
opposite, in fact--he evidently wants to help people avoid potential legal
trouble.  To use a simple analogy--if I lean out my window to tell a fellow
driver that his right front tire is going flat, should he get mad at me for
his car trouble.  To take the analogy even further, does the fact that I
might be in the tire business make me suspect?

> ITAR statutes
> are criminal statutes; if you're convicted under them, you're looking at
> hard time in Leavenworth.  Is he seriously advocating prison sentences
> for these persons, or for end-users of PGP?

It's not up to him--and if he did, why would he be warning people about it?

> (I have never seen any "rsaref" compiled
> object code for any machine, any platform; only source code. [...]

> RIPEM, built upon RSAREF, from the beta version I
> have seen (and which I downloaded by anonymous ftp from scss3.cl.msu.edu
> two weeks ago, before the ftp archive there was closed to anon-ftp
> access),

Now I'm confused.  How can you have played with RIPEM without having "seen
compiled object code" for RSAREF?  This seems contradictory.

> is a slower program with fewer options and much less
> functionality than PGP, especially on a non-Unix platform.

Well, speaking as a Macintosh bigot, they are both quite minimal, but that's
rather beside the point, I think.

> It relies heavily upon a centralized
> key distribution authority (although it can be used without such), which
> PGP does not.

Nope.  It can use a central key registry, as well as distributed key
registriy techniques (such as the convenient but insecure "finger plan"
approach), but it in no way "relies heavily" on it.

> For its single-key cipher it utilizes, ahem, DES.  Unlike
> PGP, there is no current version for Macintosh and compatible computers.

Funny, I haven't seen MacPGP 2.1 anywhere... perhaps I missed it.

> "...RIPEM users are urged to read the RSAREF license agreement
> themselves."  And Mr. Bidzos would like us to be reassured by this?

Mark isn't a lawyer.  Of *course* he urges people to read the RSAREF license
themselves.  I'm certainly reassured by this--I like to be informed about
what I am using, and I take the law very seriously even when I disagree with
it.  Civil disobedience means *accepting the penalties* for refusing to abide
by existing law.  If you are willing to resist U.S. patent law, you must by
that action be willing to accept the penalties, such as the risk of civil
litigation.  If you are willing to resist ITAR, you must perforce be willing
to accept the penalties, such as the risk of federal criminal charges.
Whatever your convictions, there is no free ride.

For the record, I oppose both software/process patents *and* ITAR coverage of
software-only encipherment systems.  However, my intellectual convictions in
no way free me from the fact that the current U.S. law remains in place.  I
can choose to disobey it as an act of protest, but if I do say I am
responsible for being prepared to lose.  For some issues, this is worth it--
for this one, so far, I think less radical attempts to change the law may be
more effective (protest only works when people know what you're protesting
about, after all).

> In the Information Age, in which we have been living for a long time now,

My friend, the "Information Age" is just starting.  The last 30 years have
been mere groundwork :).

> In this new world, they ought to be
> freely and widely available.  To bar their use, or the dissemination of
> knowledge concerning them, would be to deprive citizens of effective
> means of preserving their own privacy.  Privacy means nothing if
> effective means to preserve it are lacking.

I agree completely.

>     Consequently, I for one am not afraid to stand up and be counted as
> a supporter of the fine work of the PGP development team,

Are you afraid to stand up and be counted in civil or criminal court?  If
not, I commend you, and wish you luck.  If you aren't, then I have little
patience for your complaints.

> If it actually ends up costing me or other like-minded
> American citizens, then, in my view, this country's Constitution will
> have suffered yet another humiliating debasement.

That's all and good.  Are you willing to accept the possibility, though?




Amanda Walker
InterCon Systems Corporation