🚀 go-pugleaf

In article <1992Dec18.215750.1696@netcom.com> strnlght@netcom.com (David Sternlight) writes:

   Tim Moore makes the interesting point that PGP 2.x contains RSADSI code
   for the MD5 algorithm. He goes on to say it's licensed to all.

To avoid reading too much into my paraphrase, here's the notice from
md5.c:  

/*
 ***********************************************************************
 ** Copyright (C) 1990, RSA Data Security, Inc. All rights reserved.  **
 **                                                                   **
 ** License to copy and use this software is granted provided that    **
 ** it is identified as the "RSA Data Security, Inc. MD5 Message-     **
 ** Digest Algorithm" in all material mentioning or referencing this  **
 ** software or this function.                                        **
 **                                                                   **
 ** License is also granted to make and use derivative works          **
 ** provided that such works are identified as "derived from the RSA  **
 ** Data Security, Inc. MD5 Message-Digest Algorithm" in all          **
 ** material mentioning or referencing the derived work.              **
 **                                                                   **
 ** RSA Data Security, Inc. makes no representations concerning       **
 ** either the merchantability of this software or the suitability    **
 ** of this software for any particular purpose.  It is provided "as  **
 ** is" without express or implied warranty of any kind.              **
 **                                                                   **
 ** These notices must be retained in any copies of any part of this  **
 ** documentation and/or software.                                    **
 ***********************************************************************
 */

   Aha! The smoking gun?

Doubtful.  Most people would say that this code is "freeware"; this
header isn't too different from that included in e.g. BSD 4.4 sources,
except the loaded term "license" is used.

   RSA/PKP are not obligated to license to anyone, and may deny or even
   withdraw licenses for what they consider to be cause. If they were to

I don't see how that follows.  The "license" says nothing about RSADSI
retaining a right to restrict its distribution.  The license is in the
source file.  It is not whatever RSADSI feels that the license should
be at any given moment.

   take the position that PGP users are not entitled to a license then
   this would be "proof", if any further proof were needed, that PGP2.x
   contains illegal code. I believe that even outside the U.S. the use of
   someone else's code without permission is at least a copyright
   violation in most countries, including many from which PGP defenders
   are writing from.

Restricting use of MD5 would be an extremely stupid move on their
part.  It's interesting to contrast md5 (and the other members of the
digest family, MD2 and MD4) with RSA.  It seems like every day someone
suggests a new use for MD5 in sci.crypt, and those uses are
immediately implementable because Rivest put the md5 algorithm in the
public domain (as if algorithms could be patented :-).  I predict that
in the year 2000 the use of MD5 and follow-ons will be much more
widespread than that of RSA in the U.S.  I'll really go out on a limb
and say that RSADSI will be making more money from MD5 applications
than RSA.

--
Tim Moore                    moore@cs.utah.edu {bellcore,hplabs}!utah-cs!moore
"Wind in my hair - Shifting and drifting - Mechanical music - Adrenaline surge"
	- Rush