- cypherpunks-legacy@lists.ogf.org

Patent Bullshit and Crypto Restrictions.
by uni＠acs.bu.edu 01 May '93

01 May '93

Eli, in his infinate wisdom, says: However, I don't see RSA doing a hell of a lot to promote crypto use -- the opposite, in fact. Their software output is hardly impressive for a corporation of a decade's standing. They won't sell me a license -- they'll sell it to Lotus, but I can't see their source code. The government hasn't banned public-key encryption, but it's banned patent-infringing public-key encryption. And for practical purposes, that's the only kind there is. The combined effect of present patent law and RSA's "sue first, write code later" approach has been to stifle the development of cryptography in this country and in the world. Perhaps if encryption algorithms were not encumbered, they would already be in common use, rendering Clipper untenable. If RSA Inc. wishes to sell me a license I shouldn't have to buy, that would be nice. If they wish to show their change of heart in some other way, that would be nice too, as long as it doesn't come with a licensing agreement like RSAREF's. But if they're going to continue to sit on their patents, I'll do without their blessing. Incidentally, I don't think the issue of algorithm patents is as minor as some have portrayed it. It has blocked the use of RSA, after all, giving Clipper a window. Furthermore, there are patents on approximately every other cryptographic technique: PK in general, exponential key exchange, LUC, IDEA, DigiCash, .... Patents may gut cryptology the way they have data compression, to pick one example. This would be a shame. Eli ebrandt(a)jarthur.claremont.edu I have to agree with much of what Eli says. I have been reluctant to speak out against Tim's words until now because I respected Tim's opinions, and value his judgement. I felt I should "reflect" on the issue a little longer, before coming to any hard and fast conclusions. I thought perhaps time would soften the anger in my heart. I thought wrong. I still respect Tim's approach, but I cannot agree with it. Patents were designed to protect the financial interests of inventors. I respect this. RSA Inc. owns the patent on the engine, fine. They deserve to be rewarded for their work, their interest in developing the method, and their investment. I don't mind paying for the right to use PGP, not in the least. I'd happily compensate both Phil and RSA Inc. and PKP or whoever. IMHO PGP is worth a good $200. I think many share my view, in concept if not in degree. When patents become bullshit is when they serve special interests before they serve economic interests, or the interests of progress. Fine, life isn't fair. If the oil companies own a patent on 200 mile per gallon fuel injectors or whatever, fine. They figure they'll make more dough if they bury the "secret plans" in the darkest corners of their sphincters, fine. That's the law. That's cool. But when those plans get out, and someone starts giving away the injectors for no fee, that's progress. Sure, illegal, but progress none the less. At what point do the interests of the oil companies conflict with the environment as a whole? This is the problem I have with the patents on RSA. No one is even interested in money, like the oil companies were. The goal seems to be to RESTRICT ACCESS TO CRYPTOGRAPHY> DES all over again. Cripple it. Weaken it, can't let the real thing out. That's bullshit. Just as the NSA sought to control NSF and restrict funding, it's backstabbing regulation. Thanks be for Dr. Weingarten, an enlightened enough soul to see through the NSA bullshit and keep cryptography out in the open when they tried to shut it away. I see PKP and RSA Inc. as partners in the whole mess. They sit nice and quiet on their patent, making some vague threats everwhy once in awhile until Clipper comes out, and then they start to threaten people with action. Should I be surprised? After all if RSA gets out in any REAL implementation, Clipper is useless, AT&T (those backstabbing two faced snakes with good PR) gets fucked and Clinton looks like an asshole (ok, more like an asshole) for proposing a plan that would never work because private industry had beat him to it. Sound familiar? Like IBM, lucifer and DES perhaps? Bow down to RSA Inc? Gimme a break. Why should they fight the government, they know their patent will get them some dough. I don't even want to begin with Denning. She's got feet in both worlds. The problem is no one is going to see it until shes buried the knife in the libertarians to the hilt. What sickens me the most is the rhetoric that flys around this dung pile like buzzing flies. Crap like "citizens right to privacy" when used in the same paragraph with "law enforcement requirements" Crap like "stronger than most algorithms now on the market." Crap like "to protect us from drug dealers and terrorists." Crap like "we don't plan to outlaw cryptography" Crap like... well anything AT&T says. It all smells the same to me. The bottom line seems to be if you lay with the whore you have to wake up with the whore. Play RSA Inc., AT&T and Dorthy's game today and... what? The'll pay you back tommorow when you need it? Bullshit. Fine, we may lose the battle because business interests are stronger than an internet mailing list and the american people have an average I.Q. of 80, but at lease >I< will wake up and be able to look in the mirror. Don't sell out cypherpunks, RSA Inc. will stab you in the back as quickly as anyone else. uni (Dark)

1 0

validity of the RSA patent
by Eric Hughes 01 May '93

01 May '93

Plenty of people gripe about PKP patents. Assume for the sake of argument that the patents will be upheld, that they are valid. What, exactly, is claimed? The RSA patent claims the RSA cryptosystem. So we don't use that. The Diffie-Hellman-Merkle patent claims all of public key cryptography; in particular it claims knapsack algorithms. So we don't use knapsacks. But does this patent really prevent us from using public key cryptosystems? I think not. Mind you, I'm only an amateur legal hacker, but this seems like a straightforward situtation. Consider use of another public key encryption scheme, say LUC encryption. Does use of this infringe the "public key" patent? Not directly, since we're not using knapsacks (presumably). We then look the equivalents doctine. From Blacks: Equivalents doctrine. In patent infringement law, doctrine of "equivalents" means that if two devices do the same work in substantially the same way and accomplish substantially the same result, they are the same, even though they differ in name, form, or shape. [...] A doctrine which declares that a device infringes a patented invention if it does the same work as the invention in substantially the same way, even if it is outside the literal terms of the claims of the patent. The doctrine prevents parties from infringing patents with impunity by making merely trivial changes in an invention. The more significant the patented invetion the greater the scope of this doctrine. So we have three criteria. "Same work" refers to function, "same way" refers to internal structure, "same result" refers to end product. Now public key cryptosystems all have the same function, to provide encryption and decryption with different keys. The result is the same at the end of each public key communication: a message has been passed securely from one end of the channel to the other. The structure, however, is completely different for the different systems. All three criteria must be satisfied in order for the equivalents doctrine to hold. The requirement of same structure is not satisfied. (Matt Miszewski has today offered to do legal research in anticipation of a patent fight. I'd like to ask him here to check out this theory with some references to case law.) RIPEM, as I understand it, came out originally with a different public key algorithm and later changed it. Perhaps Mark Henderson (who seems to have done some work on it) could comment. The equivalents doctrine seems to my mind to be a dual of the criteria required for patentability. There are four such criteria: statutory class (is it the right kind of thing), utility (is is good for anything), novelty (does it have new features), and unobviousness (does it have new results). The equivalence of function means that the utility of the two objects is the same. The equivalence of structure meanse that the new invention does not exhibit novelty. The equivalence of end result means that someone already thought of that before, i.e. it's obvious. Statutory class is the same for both, since if they're that close, they both are the kind of thing which might be patented. It is interesting as well to examine which can be patented: processes, machines, manufactures, compositions (of matter), and new uses of any of the above. Note that a bundle of properties and purposes, e.g. public key cryptography, is not patentable; it fails to specify structure, so any structure would be novel. The new use clause, though, is exceedingly scary. Under this class, existing equations could be used for different purposes and be separately patentable. For example, if you were to use the RSA equations for some purpose other that public key crypto and digital signature, that would be separately patentable. It behooves us all to think widely of possible applications and talk about them in order to make them part of the prior art. I'd like to see a document containing a good argument against the claim that all public key crypto is covered. It should have the full scholarly apparatus with it and an appendix explaining the apparatus to non-lawyers. This document could then be circulated widely, starting on sci.crypt. After that, developing a test case is easy. We would need for someone to write some public key crypto code (it need not be very complicated) and market it, claiming explicitly that the "public key" patent does not apply. We'd want them to be extremely loud in their claims, for example, writing the legal departments of all of the big RSADSI licensees and offering their wares for sale. If you could collect money, so much the better. This would almost invariably draw a lawsuit, since it so directly threatens RSADSI's business. Witness the speed with which the recent PGP board was asked to shut down. Assuming that we've already arranged for the up-front cost of legal defense, we'd be ready to go. Comments? Eric

2 1

electronic democracy: approaching at megabit speed!
by ld231782＠longs.lance.colostate.edu 01 May '93

01 May '93

This came from the `privacy digest' mailing list. Of particular interest is the opening & `onlining' of government databases. Also note that the noted Sen. Leahy has expressed serious concern over the Clipper and is chairing hearings on it. `mood of declassification'? `require more openess throughout the bureacracy'? `electronic mail to improve citizen participation'? WOW! Some words that have been coined to describe this kind of thing for future sound-bite reference: `modemocracy' (saw this in a Compuserve magazine) or `netocracy' (my own coining) ===cut=here=== [ Original posting source: nigel.allen(a)canrem.com in igc:alt.news-media -- MODERATOR ] White House Official Outlines Freedom of Information Strategy at 'Information Summit' To: National Desk, Media Writer Contact: Ellen Nelson of The Freedom Forum First Amendment Center, 615-321-9588 NASHVILLE, Tenn., April 13 -- A White House official today outlined a broad open government strategy for the Clinton administration, throwing support behind legislation to apply the Freedom of Information Act to electronic records. "At the Clinton White House, most of the debate over the E-mail system is about how we can interconnect it to public services rather than how we can destroy the records or tear out the hard drives before the subpoenas come to reach us," said John Podesta, assistant to the president and staff secretary. Podesta made his comments in front of 70 participants in the nation's first Freedom of Information Summit, sponsored by The Freedom Forum First Amendment Center at Vanderbilt University. Though the economy dominates the headlines, Podesta said the new administration was quietly working across a broad front to open government. His "predictions for the first year," included: -- Working with Sen. Patrick Leahy (D-Vermont) to win approval this session for a bill allowing access to dozens of electronic databases in the federal government. -- Developing an electronic mail system within the federal government to improve citizen participation in government. -- Making the government's archives available on the nation's "information highway," and appointing a national archivist "who cares more about preserving history than about preserving his job." --Creating a "mood of declassification" with new executive orders from the president outlining what government may keep secret. -- "Reinventing government" under initiatives developed by the fall by Vice President Gore to require more openness on the part of civil servants throughout the bureaucracy. Podesta also pledged lobbying reform and political reform to "get rid of the soft money in campaigns." The Freedom of Information Act may need strengthening in addition to electronic access, he said. Pinched by a dozen years of tight information policy, news organizations have sent President Clinton a freedom of information policy paper calling for wholesale personnel changes in FOIA-related jobs, junking the secrecy classifications of President Reagan's Executive Order 12356, overhauling the Freedom of Information Act and ending military censorship of war reporting. "People working on behalf of the public on more openness in government at all levels are heartened by the prospect of the White House taking the lead in this area," said Paul McMasters, executive director of The Freedom Forum First Amendment Center at Vanderbilt University. The conference, sponsored by The Freedom Forum First Amendment Center at Vanderbilt University, is focusing on issues ranging from the Clinton administration's policies on open government to restrictions on public access to crime, accident and disaster scenes. The conference, open to the public, is at the Stouffer Hotel in downtown Nashville. Speakers on the Clinton FOI Agenda included Richard Schmidt Jr., general counsel to the American Society of Newspaper Editors and partner in the law firm of Cohn & Marks in Washington, D.C.; Theresa Amato, the director of the FOI Clearinghouse in Washington, D.C. and staff counsel for Public Citizens Litigation Group in Washington, D.C.; and Quinlan Shea, former Carter administration official who discussed problems of access to government. Former American hostage Terry Anderson will give the keynote address at the dinner tonight. The Freedom Forum First Amendment Center at Vanderbilt University is an independent operating program of The Freedom Forum. The Center's mission is to foster a better public understanding of and appreciation for First Amendment rights and values, including freedom of religion, free speech and press, the right to petition government and peaceful assembly. The Freedom Forum is a nonpartisan, international organization dedicated to free press, free speech and free spirit for all people. It is supported entirely by an endowment established by Frank E. Gannett in 1935 that has grown to more than $700 million in diversified managed assets. Its headquarters is The Freedom Forum World Center in Arlington, Va. -30- -- Canada Remote Systems - Toronto, Ontario 416-629-7000/629-7044

1 0

OUTDIAL SERVICE
by Sandy 01 May '93

01 May '93

_________________________________________________________________ SANDY SANDFORT ssandfort(a)attmail.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Nickey MacDonald wrote: ". . . has anyone ever given consideration to creating an "outdial" service? If I could dial long distance into the States, and then be able to dial a 1-800 number that I cannot dial direct from Canada (which is most) this would extremely useful." At least one service, similar to what you describe, already exists. It was created primarily to take advantage of the low long distance/international rates available only from the US. Incoming calls to the US typically cost 2-3 times as much as outgoing calls to the same countries. Once you have an account, you can call a special number in the US, key in your private code, and hang up. You will immediately be called back by the service. When you answer, you will here an American dial tone. You may then dial any number in the world. The service charges you a fee that is substantially less than the international rates charges in your home country. Of course, it also allows you to call US 800 numbers, as well. The company, ITS, offers other services including programs for Americans (or anybody) travelling abroad. For more information, contact: International Telephone Services, Inc. 1750 K Street, N.W., Suite 380 Washington, DC 20006 Tel: 202 223 1307 Fax: 202 296 1643 S a n d y Please respond ONLY to: ssandfort(a)attmail.com _________________________________________________________________

1 0

PGP on soda.berkely.edu
by Hal 01 May '93

01 May '93

-----BEGIN ??? SIGNED MESSAGE----- I want to apologize to Eric and Tim for intimating that their motives in exploring the possibility of closer ties to RSADSI were due to pressure from that company and its officers. I had apparently misinterpreted Eric's statements about the popularity of the Cypherpunks FTP directories to conclude that it was a major distribution site for PGP. I am glad to hear that Eric and Tim are not facing any immediate legal problems due to their support for this software. Turning to the issue under discussion, I do have a couple of other thoughts. First, I don't see that the interests of RSADSI are fully aligned with ours regarding Clipper. Despite PKP's success in accumulating patents, Clipper per se does not appear to infringe, being based on a new symmetric cryptosystem. So they don't have any direct leverage over the use of Clipper. Now, Clipper-based phones presumably need some way to exchange keys, and here PKP's patents are likely to be relevant. But I was under the impression that AT&T, at least, was already producing secure telephones. I don't see why whatever arrangements they made for key exchange under their previous technology would have to be changed with Clipper. In fact, Clipper in some ways represents a major market opportunity for PKP. To the extent that the publicity leads to increased sales of encrypting phones, PKP may benefit from the success of the Clipper. (The follow-on Capstone project does appear to pose a greater threat to PKP, since it will use DSS (for key exchange???).) Furthermore, in any future government prohibition on non-Clipper cryptography, our greatest nightmare, it is plausible that the government would "take care" of PKP by making sure that they get a nice piece of the pie. I could easily imagine a situation in which non-Clipper crypto is banned, Clipper is widely distributed, and PKP is doing very well financially with a slice of the profits from every sale. Even if Jim Bidzos were personally committed to widespread, strong, public cryptography, and opposed Clipper for fundamental philosophical reasons (just like us), he would be faced with a conflict of interest. As several people have pointed out here, Bidzos has a fiduciary responsibility to his shareholders to maximize profits for his twin companies. If it comes down to a choice between opposing Clipper on principle and accepting it along with guaranteed profits, he may be forced (in the same sense in which he is forced to send threats to Stanton McCandlish) to back Clipper. So, even if Bidzos is personally a nice guy I think we need to remember that his company may not be a natural ally of ours. One final point, for now. I like Tim's .sig and all it represents. But frankly, it is hard for me to square a commitment to radical change with the proposed alliance with PKP. Part of the trouble is that I still don't understand exactly what our relationship with RSADSI is proposed to become. But at a minimum it sounds like we would avoid supporting activities which would infringe on their patents. That means that when we want to start working on some of those things in Tim's .sig, we are in many cases going to have to get Jim Bidzos's permission. Can you imagine asking something like this: "Dear Jim: We request permission to use the RSA algorithm for an implementation of digital cash which we will distribute in an underground way among BBS's all over the world, with the goal being the support of "information markets, black markets, [and] smashing of governments" (to quote Tim's excellent .sig). "Please sign on the dotted line below. Yours truly, an anonymous Cypherpunk." Obviously there is no way Bidzos could give such approval. Even if he personally were a card-carrying member of the Anarchist Party he could not bear the legal liability that someone in his position would take if he granted this request. How, exactly, are we supposed to progress towards Crypto Anarchy if we have to be sure not to step on PKP's toes? Do we just not ask him for permission (in which case we are in PGP's boat)? Do we ask for permission without revealing the full scope of the project (in which case it may be rescinded later)? I am not being facetious here. I honestly don't see how you can carry out Cypherpunk activities with a corporate sponsor. I guess that's enough for now... Hal 74076.1041(a)compuserve.com -----BEGIN ??? SIGNATURE----- Version: 2.2 iQCVAgUBK+HUu6gTA69YIUw3AQF9hAP+K6HXxXxjpK2qmjtFmj6LnWFW10KG09P+ o09BpbCJsiXTulv85XEtDfTyqus+T9o2dp01xaJaj0T/En3nKPs7NjKlgNciLmhV 3gzAAuv3VedheUR4cLuZOKxk6MkcwywRB4T/PHPomJ411FeYHI1DgBxZEbpM25e0 Y5mk4vQP+oo= =zKde -----END ??? SIGNATURE-----

1 0

Re: Introduction...
by Sy Verpunc 01 May '93

01 May '93

I wrote: : To whoever it was at Ohio who just fingered this account... (whether it's : one of us or the obligatory NSA mole :-) [oops, no, the NSA mole works out : of uunet.ca, right?]) - I'll save you the bother - it's not a cunning alias, What a nosey bunch... I've had this machine on the net for almost a year and not been fingered by as many strangers as over the last three days. Anyway, here's a little experiment in paranoia... which of these people *aren't* cypherpunks...? I've always wondered if joining a list like this would bring unwelcome attention... I've marked the people who I know are on the cypherpunks list with a *. If any of the rest of them are 'one of us', let me know. By elimination we'll work out where the gummint spies hide out :) ... (The machines that reject finger requests and telnet VRFYs are pretty suspicious...) And I'm also particularly suspicious of the finger from ohio-state - it *was* someone who reads this list (the svp ID was created especially for it) but there are *no* ohio-state sites in the mailing list at all. If this is considered a waste of the list's bandwidth, flame me privately... In fact, reply privately whatever you have to say... (gtoal(a)gtoal.com) Apr 27 20:03:05 finger from serdlc21.essex.ac.uk [155.245.11.40] Apr 27 20:03:18 guest Guest p3 Wed 20:00 Apr 27 20:03:18 millph P H Mills p5 Wed 19:44 Apr 27 20:03:18 guest Guest p6 Wed 20:25 Apr 27 20:03:18 guest Guest p7 Wed 20:31 Apr 27 23:10:19 finger from PANAM1.PANAM.EDU [129.113.1.2] Apr 27 23:10:44 GMJ2393B Jimenez, George M 20401FE1 FINGER LTA6549DSCC08/PORT4 Apr 27 23:13:08 finger gtoal from uunet.ca [142.77.1.1] Apr 28 19:48:53 finger from harrip(a)serdlc23.essex.ac.uk [155.245.11.42] Apr 28 19:49:13 harrip P Harrington p2 Thu 19:47 Apr 29 18:58:05 finger svp from mathserv.mps.ohio-state.edu [128.146.110.31] Apr 29 19:32:17 finger from mathserv.mps.ohio-state.edu [128.146.110.31] [! denotes no idle time during both fingers] akos alden aparson baker bkm bloch bogdan cao carlson chohan cthomas! davis dijen edgar falkner fcarroll fiedorow! forest ggelder! goedde goss haar hamilton! haradako harmon henri holbrook hpallen huneke jocha kappeler lguo ling! lingshu march morlet! neumann! nevai ogle overman patmac! ponomar rld robertso! root siegel singhi! sinha! sinnott stanton tanveer terman wang Apr 29 19:38:15 *finger gtoal from ee92jks(a)monge.brunel.ac.uk [134.83.72.1] Apr 29 19:38:20 ee92jks Jonathan K Saville *p1 Fri 20:03 cc-02.brunel.ac. Apr 29 19:44:11 finger svp from seneca.SED.Provo.Novell.COM [137.65.96.1] Apr 29 19:45:11 finger gtoal from seneca.SED.Provo.Novell.COM [137.65.96.1] ?*<Tim_Myers(a)Novell.COM (Myers, Tim)> Apr 29 23:23:21 finger gtoal from sck(a)naucse.cse.nau.edu [134.114.64.1] Apr 29 23:23:27 sck Sean Koontz *p1 Fri 13:41 =*<koontz(a)raslon.iac.honeywell.com> Apr 30 00:01:39 finger gtoal from dent.uchicago.edu [128.135.72.13] PS Someone mailed me to ask how I knew if I'd been fingered - it's a combination of a home-hacked fingerd and the log_tcp wrapper package.

1 0

Re: 800 numbers
by Sy Verpunc 01 May '93

01 May '93

From: Nickey MacDonald <i6t4(a)jupiter.sun.csd.unb.ca> Of course, only Americans can dial those numbers.. which is a shame... (A few Canadians could have skewed the voting... :-) On a note similar to remailers, has anyone ever given consideration to creating an "outdial" service? If I could dial long distance into the States, and then be able to dial a 1-800 number that I cannot dial direct from Canada (which is most) this would extremely useful... Could be taken mail me your pgp key... G

1 0

unsubsribe
by cplai＠csie.nctu.edu.tw 01 May '93

01 May '93

Please, unsubsribe me now. Please, unsubsribe me now.

1 0

PGP on soda.berkeley.edu
by Hal 01 May '93

01 May '93

The fact that PGP is available on the Cypherpunks FTP site, soda.berkely.edu, was publicized in sci.crypt last week (among other places and times). Eric said that the Cypherpunks FTP site has become among the top FTP access points in the world. When Stanton McCandlish posted on sci.crypt that he had PGP available on his system, he quickly received threats from Jim Bidzos demanding that he remove it. It follows, doesn't it, that Jim Bidzos would be forced to apply similar legal pressure to the Cypherpunks leadership to get them to remove PGP from their site, a site which may be one of the leaders worldwide in distributing PGP. Now we see Tim suggesting (in the spirit of "pancritical rationalism"? I'm not so sure...) that we move away from PGP, and Eric offering arguments showing why Bidzos has to do what he is doing. Is there a connection? Are Tim and Eric under pressure from Bidzos to get PGP off their site? I don't know, but they would certainly be likely targets for Bidzos' efforts, and so it is understandable that they may be feeling personal discomfort. But I'd like to hear more about the relationship with Bidzos. Hal

3 2

Re: I don't take it personally...
by tien 01 May '93

01 May '93

Tim, I'm responding to your question about patents. I don't know of any reason why individual licenses to use the public-key patents in connection with specified authorized programs couldn't be granted under U.S. patent law. In general, a patent holder has the right to exclude unauthorized persons from making, using, or selling the patented invention. A patent holder can grant non- exclusive licenses to make, use, or sell. Legally speaking, a non-exclusive license can be thought of as a promise by the paent holder not to sue the licensee for acts within the scope of the license which would otherwise constitute patent infringement, in return for some kind of consideration. The major limits on a valid patent are "patent misuse" (where the patent holder overreaches) and antitrust (where the patent holder uses the patent to restrain trade). Patent licensing is a pretty flexible mechanism. I'm no expert, though, and I've never quite understood exactly what this patent protects, nor have I seen the actual claims of the issued patent. Lee

1 0