🚀 go-pugleaf

Since I don't like to argue for argument's sake, and since a recent
development (see my post on the RSAREF license, and make what
inferences you like about the imminent release of RIPEM) has made
this discussion moot, from my point of view, if Vesselin wants to
be right, he may be so. I think the issues have been clearly spelled
out, and users, being adults, may do what they wish in full knowledge
of the issues and arguments.

As for me, my RIPEM public key is available on the server. Since I
do not expect any cryptographic communications for any particular
reason (though RIPEM users are welcome to send them), much less from
outside the U.S., that RIPEM is not legally available outside the
U.S. and Canada is of little personal moment.

As for the understandable desire of many for universal privacy-
enhanced communications, from my own personal point of view
(WARNING-not "the truth" but just what I believe) there are several
ways to achieve this which I would not have any questions about:

1. For PGP to be written from scratch in the U.S. to incorporate
RSAREF, thus permitting communications between the U.S. version
and any other while honoring what I understand to be RSA's patents
and the Munitions laws. Such a rewrite could be used here, but
not exported. I don't think there's a problem with exporting
messages and keys themselves.

2. For RIPEM's cryptographic components (DES and RSAREF) to somehow
be rewritten de novo outside the U.S. to be consistent with national
crypto and patent laws, thus permitting communications between the
U.S. version of RIPEM and any other.

3. For RIPEM to be upgraded in the U.S. to include IDEA, and PGP format
compatibilty.

4. For the Munitions Act/ITAR regulations to be changed AND PKP's
patents overturned (or expire).

I think 4. is both unlikely and will take some time if it happens.

My understanding of 3. is that if the RIPEM author gets many requests,
he will consider it, but not otherwise. Note that a modification of
RSAREF to handle certificates, etc. (if that's where it has to be
handled in software) is not a performance modification under the terms
of the RSAREF license, and thus requires RSA's permission.  The
license does say they won't deny such permission for "all reasonable
requests."

I suspect 2. is unlikely without some illegal export from the U.S.

I understand some are working on 1., and the RSAREF license should
make their job much easier.

David