🚀 go-pugleaf

boucher@csl.sri.com (Peter K. Boucher) writes:

> First, it is illegal to "make, use, or sell" a patented device
> without a license.  PGP's disclaimer does not protect anyone making,
> distributing, or using PGP.  PKP owns the patent and sells licenses
> to companies who want to make and sell products that use RSA and

In the RSA FAQ it is stated that PKP allows free usage of RSA for
non-commercial use. I was unable to obtain an official answer from
them why (and if) this excludes PGP.

> other public-key cryptography.  PGP is not licensed.  A license to
> the maker of PGP has always been (and still is) available, but it
> would not be free (which would be unfair to other licensees, whose
> licenses were not free).

Nope, PKP promptly refuses to issue licenses for PGP, even if you
offer to pay them.

> Second, PGP may be illegal with respect to US export law.  The

True, it is illegal to export PGP from the USA. Fortunately, the world
does not consist of the USA alone, so you can safely IMPORT the
package from dozens of ftp sites around the world. Importing it in the
USA is NOT illegal (actually using it is another story).

> author states in the documentation that he "guided" its development
> overseas.  This might be construed an export of "technical know-how"
> under the ITAR (International Traffic in Arms Regulations).  By

If anybody wants to sue the author (which one? PGP 2.0 has been
written by several people; none of them has done anything illegal,
even according to the USA laws), s/he must first prove that he has
indeed "guided its development overseas". What is stated in the docs
has no value as a proof.

> distributing or using PGP 2.0, you may be involved directly or
> indirectly in an illegal act.  Ignorance before the law, of course,

1) Importing PGP in the USA is not illegal.

2) Distributing PGP is not illegal anywhere.

3) Using PGP for non-commercial purpose in the USA is probably not
illegal, but this needs further checking. Using PGP outside the USA is
not illegal.

4) Exporting PGP from the USA is probably illegal, but who the hell
needs it?

> making a decision.  It could be a serious mistake to assume that
> because this software "appeared" in the US or elsewhere, it and those
> who use it are not at any risk of violating export law.

Sure, don't export it from the USA, if you want to be on the safe
side.

> The risks to those actively promoting PGP, and/or distributing it, are
> of course, greater than those for simple users, but even simple users

You probably mean "risks to the US users", but even then your claim
needs proofs. For everybody else (outside the USA, which is still the
majority), there are absolutely no risks in actively promoting,
distributing, and using PGP.

> would do well to seek an acceptable alternative, such as RIPEM.

A better solution IMHO would be if PGP becomes PEM-compatible. This
way the US users will be able to use RIPEM and people in the rest of
the world will be able to use PGP.

> RIPEM is built on a piece of software called RSAREF.  RSAREF contains
> an embedded patent license, and is perfectly legal to use for
> non-commercial purposes.  Any software whatsoever can be built on
> RSAREF, even PGP-like programs, and distributed freely.  RSAREF does
> carry strong restrictions on export.  RIPEM source and executables can
> be found using archie.

Because "RSAREF does carry strong restrictions on export", nobody
outside the USA is able to obtain it legally. That's why, we are
sticking to PGP. If only PGP were PEM-compatible, everybody could
choose his/her favourite/allowed program, not worry, and be happy...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany