- cypherpunks-legacy@lists.ogf.org

RE: HELP! Some nut is threatening to sue!
by tcmay＠netcom.com 29 Apr '93

29 Apr '93

Dr. Zaphod writes, commenting on Jim Bidzos' e-mail to Stanton M., > For a guy who claims to want to help us Cypherpunks in the way of >personal encryption, scare tactics seem a little out of place. I'm sure >we'd all like to use legal encryption methods [maybe]... but we ARE >Cypherpunks.. giving us the responsibility to use what's best and defend our >rights for privacy. Using a package that hasn't been updated in 5 years >[MailSafe], we have diminished to politically correct yippies. I;m not sure >quite what to do.. but I saw Jim Bidzos on a magazine once.. and he looks >like a fed. >By playing the game we are becoming part of it. TTFN. * The scare tactics may have been somewhat too harsh, or at least phrased in typical "cease and desist" lawyer terms, but Stanton _did_ post his announcement very prominently and widely in sci.crypt, where everyone could see it. RSADSI was pretty much forced to react, lest they later find their patents/copyrights/whatever ruled invalid by their failure to protect them. Most PGP sites are less well-advertised :-}. * I agree that PGP has a feature set (especially its distributed trust model) that is more interesting than the creaky old MailSafe program. There may be several solutions brewing here, as several postings in this thread have noted. * As George Gleason has also noted, dividing our community may play into the government's hands. (Some may think I'm trying to fragment the PGP community with these comments. Not at all. PGP has done a valuable service in educating hackers, users, etc., and in energizing the community. But keeping crypto "underground," as by nature PGP must be, is not what we want, is it?) * I once thought RSA Data Security Inc. was NSA-controlled. This was in 1988 or so, when I tried to buy a crypto package from them and got the run-around ("Don't call us, we'll call you."). It seemed natural, to me at that time, that the Agency would control such a crucial technology. This opinion didn't last too long, as I got more familiar with the crypto community. Now I'm convinced otherwise, and that Clipper/Capstone is in fact the government's way of gaining control of a technology they failed to classify and control the first time around. (To be sure, the export controls and other legal restrictions are a way the Agency and others control the spread of strong crypto, but so far there has been no basic challenge to the "right to encrypt." Many of us see Clipper as a probable move in this direction. Time will tell.) After meeting many of the principals, including some early investors (like Alan Alcorn, of Atari fame, at the Hackers Conference), I came to a different conclusion: RSA Data Security was just concentrating on the "big deals" which are only now coming to fruition--the zillion-copy deals with large companies like Apple, Microsoft, Lotus, etc.. This market is vastly larger than the PGP community, which may be as "small" as several thousand copies (does anybody have any better guesses?). And it turns out anyone _can_ buy a personal encryption package from RSADSI...it's called MailSafe. In 1991, I stopped off at the offices of RSA in Redwood City, while on my way to Lake Tahoe to the Hackers Conference, to pick up my copy of MailSafe and ran into Jim Bidzos. We talked about PGP (1.0 in those days) and about the upcoming Hackers Conference. Jim made an interesting offer: Anyone at the Hackers Conference could buy MailSafe for $50, just by saying they were there. This fee barely covered the manufacturing/packaging costs, as I'm sure you all know. So far as I know, a handful of people followed up. (And I agree there's a perceived problem that no one, especially in our community, uses it. That's why I have both a MailSafe and a PGP key...I figure I'm pretty safe against any legal charges, as I can always wave my MailSafe license in the air!) Several other conversations have convinced me that Bidzos is not a Fed. Also, his company has sponsored two excellent (and *free*, by the way!) conferences on crypto, featuring speakers from outside his company (such as Mark Riordan of RIPEM fame) and talks highly critical of the "Digital Signature Standard" (DSS), which the real Feds were pushing as a weak alternative to RSA digital signatures. (By the way, DSS is part of the new Capstone system, unsurprisingly.) * I'm not a lawyer (which is why I'll cc Mike Godwin and Lee Tien on this response), but my understanding is that the RSA patents cannot just be licensed on a "per person" basis...that's just not the way patents work. That is, we can't just pay RSA a quite reasonable $50 apiece for a perpetual license to the patents and be done with it. Instead, each product that uses the patents must be separately licensed, as per patent laws. (This doesn't mean the fee is anywhere _near_ the $125 for MailSafe, the $50 fee I suggested here, etc. I suspect the deals with Apple, Lotus, etc., resulted in _much_ lower fees, perhaps just a couple of bucks per user. Just a guess.) * A "personal encryption" product, for users who don't use commercial e-mail products such as Lotus Notes (which contains RSA), is sorely needed. The PGP distributed trust model and other features, combined with a fully legal "crypto core," could be a real success. (Personally, I'd like to see a commercial version of "Eudora," the Macintosh off-line mail reader I now use, with easier (push-button, automatic) support for PGP, RIPEM, etc.). * The upcoming battle for strong crypto is as important a battle for civil liberties as our generation will ever face, in my opinion. The precendents set in the next several years will shape this country (and other countries, by extension) for many years to come. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, smashing of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available. Waco Massacre + Big Brother Wiretap Chip = A Nazi Regime

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by karn＠qualcomm.com 29 Apr '93

29 Apr '93

I think the ball's already in Bidzos's court. Consider the following Bidzos quote a few days ago on the "billcryp" list: You have it correct, but let me expand a bit. It would be a bad business decision for us to try to keep *anyone* out of the market with patents because we disagree with their approach. Remember, personal choice crypto isn't outlawed yet. Now the context of this quote was whether RSA could use its patents to try to squash the more objectionable aspects of Clipper (particularly key registration), but his wording is (perhaps unintentionally) much more revealing. It implies to me that licensing PGP would be in RSADSI's best business interests. And so it would, if not for the personal animosity between Bidzos and Zimmerman. I sent a note to Bidzos asking him this exact question, but I have not yet received a reply. I am yet another person who would be glad to pay RSADSI a reasonable fee to use RSA in the form of PGP. Cost is really not the main issue here; PGP is the product I want to use, plain and simple. Nothing else matches its features, especially the "web of trust" model for certificates and the widespread availability of source code for inspection. Mailsafe isn't even in the running. I use PGP only occasionally, in a personal and educational mode. I would very much like to be able to recommend it to my company for business use, but I can't do that under the present circumstances. And that's too bad. Phil

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by Bob Stratton 29 Apr '93

29 Apr '93

> From: markh(a)wimsey.bc.ca (Mark C. Henderson) > Date: Thu, 29 Apr 1993 11:11:20 PDT > Subject: Re: Tough Choices: PGP vs. RSA Data Security > > > 6. RIPEM currently has no way to handle certificates or sign other > people's public keys. This is, of course, serious. The Macintosh RIPEM client does/will have certificate creation functionality RSN. In fact, RSA's even running a low-security persona certification authority that interoperates with them, as we speak. --Strat

1 0

Raving on..
by crunch＠netcom.com 29 Apr '93

29 Apr '93

>> Who wants to collaborativly work on an information packet containing >> a collection of the previous reports on the wiretap chip, such as >> the initial white house statement, CPSR's and EFF's responses, >> list of questions that were hashed at the last Cypherpunks meeting, >> etc, etc. >I already have such an archive (missing the cypherpunk questions [I had >a mail blowout, and that was one of the casualties, along with a couple >other saved items, mostly criticisms of the the privacy clipper.]) >Lemme know if you need it. I have it in .ZIP format, so you'll need >some way to deal with that. Great!! What we need is for someone who can read ZIP files and get it into hard copy for reproduction to be handed out at raves. Who wants to take on this responsibility? Geoff, now that one of my mailing lists has just dissolved (TCL_TALK) I can now join the sfRaves group and work with them directly, but first I want to write up a short introduction. JD

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by dmandl＠lehman.com 29 Apr '93

29 Apr '93

A new PGP with an RSA-approved engine and a reasonable license fee sounds fine to me. --Dave.

1 0

CSPAN NOT covering the hearings tommorrow
by crunch＠netcom.com 29 Apr '93

29 Apr '93

Called CSPAN, and they are NOT covering the hearings tommorrow. Hah! our tax dollars at work!! So, for those very luckey people going to attend, we plead with you to please write up a comprehensive report and send it to the group (or at least to me!!). JD

2 1

RE: HELP! Some nut is threatening to sue!
by DrZaphod 29 Apr '93

29 Apr '93

In Message Wed, 28 Apr 93 21:31:10 MDT, Stanton McCandlish <hydra.unm.edu!anton(a)netcomsv.netcom.com> writes: >Due to my posts to sci.crypt and elsewhere that I was distributing PGP, >I recieved the following >From: jim(a)RSA.COM (Jim Bidzos) >To: anton(a)hydra.unm.edu >Subject: pgp > >I don't think you're aware of our position on pgp. Unfortunately, you >may leave us no choice but to take legal action, which we will unless >you cease promotion adn distribution of pgp. The next message will >state our position. For a guy who claims to want to help us Cypherpunks in the way of personal encryption, scare tactics seem a little out of place. I'm sure we'd all like to use legal encryption methods [maybe]... but we ARE Cypherpunks.. giving us the responsibility to use what's best and defend our rights for privacy. Using a package that hasn't been updated in 5 years [MailSafe], we have diminished to politically correct yippies. I;m not sure quite what to do.. but I saw Jim Bidzos on a magazine once.. and he looks like a fed. By playing the game we are becoming part of it. TTFN. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)ncselxsi.uucp]# [MindPolice Censored This Bit] - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

2 1

Re: Tough Choices: PGP vs. RSA Data Security
by George A. Gleason 29 Apr '93

29 Apr '93

At risk of getting the goats of some friends of mine who read the list, I'm tending to agree with Tim's ideas here. Brief conversation with Jim Bidzos at the cypunx mtg indicated that he is very much up for something along the lines of a personal encryption product that would meet our needs. From a business perspective it's easy to see why RSA haven't gone for this yet; a copmany needs to concentrate at first on the most likely profitable lines of operation, and once that's solid, go for the wider market. Right now we have an incredible array of crypto talent which can be brought into a cooperative arrangement in developing additional RSA products. The result may turn out to be as good as the best potentials of PGP, and at the same time, support for RSA's position vis-a-vis any possible govt attempt to go after the patents. I don't see this as a matter of withdrawing support from the people and efforts which brought forth PGP. They're going to have their hands full doing *something* about Clipper right now, and that will deserve a lot of support. PGP has fulfilled its promise in many ways. It pre-empted the chance of an early govt ban on private crypto. It stimulated wide interest in crypto. It also provided a great market demonstration for the potential of an affordable strong personal encryption program. By this time, Jim Bidzos has a great case to make to his stockholders, for the business potential of personal cryptography. And PGP also brought together a wide community of cryptologists and programmers and end-users and so on. Consider a band who release a record on an underground label, which then makes it onto college radio in a big way, and the band gets a chance to get major distribution from that. They'd be dumb not to, as long as they can keep their artistic autonomy; and a smart record company executive knows that it's better not to try to tamper with a Good Thing. So here we are at the next step; public keys for the masses have the chance to come aboveground in a big way, and achieve even wider distribution and use. Now if those carrots aren't tasty enough; consider the stick: there is a long history of the govt doing in its adversaries by divide-&-conquer, along the lines of getting all kinds of infighting going among people who would be logical allies. Read the history of COINTELPRO for many examples. A major rift between PGP and RSA folks will only serve the interests of those who would rather both systems be banned. On the other hand, increased cooperation builds strength against possible governmental action in the future. -gg

2 1

Re: Tough Choices: PGP vs. RSA Data Security
by Sy Verpunc 29 Apr '93

29 Apr '93

: At risk of getting the goats of some friends of mine who read the list, I'm : tending to agree with Tim's ideas here. Brief conversation with Jim Bidzos : at the cypunx mtg indicated that he is very much up for something along the : lines of a personal encryption product that would meet our needs. From a All he has to do is let us pay a licence fee for pgp. What's the advantage to him in asking for a different piece of code that uses RSAREF and DES instead of Phil's code and IDEA? I can't see it, except that using DES blows away the security of the program... No, I think this suggestion should be put down now, or we'll splinter and give them exactly the divide-and-conquer opening they're looking for. G

3 2

Re: Tough Choices: PGP vs. RSA Data Security
by nmh＠thumper.bellcore.com 29 Apr '93

29 Apr '93

Let me add one vote of support to your proposal ... and another reason you may not have considered. I use PGP for personal communications. I'm not a big enough target for anyone to sue. On the other hand I do *not* use PGP for anything related to my employment. My company (Bellcore) is large enough to get sued, and everyone loves to hate the telephone industry. As a result, I would happily pay a resonable license fee. Neil Haller nmh(a)thumper.bellcore.com

2 1