NetNews Usenet Archive 1992 #26/NN_1992_26.iso/spool/sci/crypt/4516

Internet Message Format | 1992-11-09 | 4.7 KB

Path: sparky!uunet!europa.asd.contel.com!darwin.sura.net!zaphod.mps.ohio-state.edu!cs.utexas.edu!sun-barr!decwrl!decwrl!waikato.ac.nz!aukuni.ac.nz!cs18.cs.aukuni.ac.nz!pgut1
Newsgroups: sci.crypt
Subject: Re: RSA marketing weakness or lack of demand?
Message-ID: <[e-mail]>
From: [e-mail] (Peter Gutmann)
Date: Tue, 10 Nov 1992 00:16:17 GMT
References: <[e-mail]> <[e-mail]> <[e-mail]>
Organization: Computer Science Dept. University of Auckland
Lines: 78

In <[e-mail]> [e-mail] (David Sternlight) writes:

>There are a number of problems with this notion. First, they've been willing
>to license the RSA subroutine package pretty readily--for example to all the
>beta testers of ripem (a system roughly similar in concept to pgp).

[I presume you mean RSAREF here].

The problem with RSAREF is that it's essentially a toy implementation, in
addition to being extreme crippleware (you can't do much with it, and because
of the restrictions on its use there's no escape either) - that summary of
RSAREF is merely IMHO BTW.  RSAREF is basically something which PKP/RSADSI can
throw out to the masses, say "Look what nice guys we are, we're giving people
RSA code", and yet offer no threat at all to their current stranglehold on RSA
encryption.  To quote the PGP docs:

  "Apparently [Phil Zimmermanns] release of PGP helped provide the impetus
   for [PKP] to offer some sort of a freeware-style license for noncommercial
   use of the RSA algorithm".

RSAREF is a nice red herring, but little else....

Rhetorical question for people who've used RSAREF:

Assuming for the moment *no legal pressure from PKP*, and given the choice
between using RSAREF with all it's attached conditions and caveats, or
equivalent routines you've implemented yourself from scratch, which would you
prefer?

>Second, though pgp uses IDEA rather than DES, it does use the public key
>system, and apparently there's no objection provided it's for non-commercial
>use.

Yes there is....it seems half the users of PGP in the US live in fear and
trembling of using PGP *for private, non-commercial use*, for fear of what PKP
will do to them.  Phil Zimmermann has had to stop working on PGP although he
makes no money from it, due to PKP threatening him with legal action.
According to Phil, Jim Bidzos, president of PKP, has said he will *never*
license PGP.  This doesn't sound like "no objections" to me.

>I fear we either have to look elsewhere for a satisfactory explanation for
>RSA/PKP partner's failure to market the system software more widely and
>vigorously, or the USG has been pretty silly in their attempts to control it
>via that path.

I disagree.  If the USG *is* trying to control it via that path, then whoever
dreamed up the idea was probably given some sort of medal for it.  The PKP
stranglehold on PKC's is probably the biggest single reason why the entire
world isn't currently using public-key encryption on a day-to-day basis.  Sure,
the US export restrictions help, but if people really want it they'll either
get it out of the US somehow, or they'll manufacture it outside the US.
However noone wants to use a cryptosystem for which they know that any use
within the US will cause PKP's lawyers to come down on them like a ton of
bricks.  I don't know whether the USG has used PKP to control PKC's (TLA,
TLA:-), but if they did then they've done a darn good job.  I'll leave you with
this quote from the PGP docs:

  "Not only did PKP acquire the exclusive patent rights for the RSA
   cryptosystem, which was developed with your tax dollars, but they also
   somehow acquired the exclusive rights to three other patents covering rival
   public key schemes invented by others, also developed with your tax dollars.
   This essentially gives one company a legal lock in the USA on nearly all
   practical public key cryptosystems.  They even appear to be claiming patent
   rights on the very concept of public key cryptography, regardless of what
   clever new original algorithms are independently invented by others.  And
   you thought patent law was designed to encourage innovation!  PKP does not
   actually develop any software-- they don't even have an engineering
   department-- they are essentially a litigation company.

   Public key cryptography is destined to become a crucial technology in the
   protection of our civil liberties and privacy in our increasingly connected
   society.  Why should the Government try to limit access to this key
   technology, when a single monopoly can do it for them?"

Peter.
--
    [e-mail] || [e-mail] || [e-mail]
               (In order of preference)