🚀 go-pugleaf

In article <iDLTTB12w165w@mantis.co.uk>, mathew <mathew@mantis.co.uk> writes:
> Well, let's see.  I believe RSA was developed at MIT, and paid for by the US
> taxpayer.  I understand that when it was announced, the US government
> attempted to cover up the whole business and bury the technology, but that
> they failed because A.K. Dewdney of Scientific American and various other
> people mailed out photocopies of the appropriate papers to all and sundry,
> having been 'leaked' copies of the articles before or shortly after initial
> publication.

That story appears to be false.  See ``Kahn on Codes'', p. 200.
Briefly, an ``eccentric'' NSA employee wrote to the IEEE warning them
that a conference session on cryptology was in violation of the law.
For a time, MIT suspended distribution of (I think) the RSA paper.  The
Senate Intelligence Committee later investigated, and determined that
this employee was acting on his own, not in his official capacity or
with the approval of his superiors.  Kahn appears to believe that,
incidentally.

> I gather that it was then arranged for a series of patents to be applied for
> retrospectively.  (That is, I'm told, why the patents are not valid outside
> the US; they were applied for after publication.)  These patents were
> apparently handed on a plate to PKP, a company which seems to have done very
> little other than threaten litigation.

U.S. patent law permits applications to filed up to one year after
publication.  There is nothing underhanded about that; it's simply
different than in the rest of the world.  And it applies to everyone --
I know someone who's applying for a patent under just those circumstances,
and it has nothing whatsoever to do with security or cryptography.

As for what PKP is -- it's a subsidiary (not wholly-owned, I think,
though I could be wrong) of RSADSI.  Its purpose in life is to hold and
license public key patents.  They're not supposed to do anything else.
RSADSI does development; you're perfectly free to claim that their code
is lousy, or that they do a bad job of marketing stuff, but they do
exist.  PKP's power comes from the fact that it holds the licensing
rights to both RSA and Diffie-Hellman -- an arrangement that's arguably
monopolistic, and hence challengeable in court.  I don't know of any
government connection.

> Although they're a completely independent organization, and nothing at all to
> do with the US government, PKP seem strangely reticent to license the RSA
> patents to ordinary citizens who want to use RSA.  In fact, they refuse point
> blank to license the patents to people who want to use PGP.  Odd, eh?

That's probably a business decision.  Look at it from their perspective --
how would they enforce their license?  This is freeware, code that's
all over the Internet.  How would they collect their royalties?  And it's
in competition with PEM, from which they will profit, and which has a
built-in royalty payment structure, via certificate recertification.
(To see what I mean here, go read the (draft, I think) RFCs on PEM, and
see how the certificate-signing units are going to be built.  They'll
be in tamper-resistant boxes that send PEM mail back to the owners
every time a certificate is signed!)

Again -- you may not like their business decisions, nor think they make
much sense.  But hey -- American law doesn't guarantee you a profit
from your patents, nor even that you won't go bankrupt (unless, of course,
you're an S&L, or Chrysler...).  They have their own strategies.  But
I think you're being unnecessarily paranoid.  Want something to be
paranoid about?  Look at the encryption scheme just blessed for export
by the Software Publisher's Association and NSA -- and at the key
lengths that NSA will permit to go out, including, as I recall, RSA.
What does that tell you?