🚀 go-pugleaf

I thought I'd mention a few things that show RSA Data Security and Jim
Bidzos (their President) to not be all bad, vis-a-vis the recent
discussion of PGP and licensing of the RSA patents.

First, I'm an occasional user of both MacPGP and MailSafe (for DOS
only). Second, I posted the "Trial Balloon to Ban Encryption?" piece
on Prof. Denning's ideas about key registration, so I'm not exactly a
shill for the national security state.

Having said this, I don't believe RSA Data Security is acting to limit
the availability of their encryption products, as some have suggested.
I agree that MailSafe, one of their standalone end-user products (and
the closest thing they have to PGP), is not well-marketed...I had to
contact them directly to buy a copy. But Jim Bidzos was so eager to
get "hackers" to use MailSafe that he made a special offer.

Mr. Bidzos authorized me to announce at the Hackers Conference in
1991, a year ago, that anyone attending the conference could get
MailSafe for $50, a substantial reduction from the $125 price at that
time (I have no idea what the current price is). The idea was that
this would nearly eliminate the complaints of those who wanted their
RSA encryption for free.

(Personally, I'm opposed to software patents in general, and the
patenting of the general math techniques used in RSA in particular.
Patenting the kind of math used in RSA is akin to letting Trimble
Navigation, for example, patent the Pythagorean Theorem just because
they use it in their product. Rivest, Shamir, Adleman, Diffie,
Hellman, and Merkle all deserve the fame they've gotten, but allowing
a patent on a fairly simple number theory algorithm is wrong.)

Several folks at that Hackers Conference took advantage of the offer.
But not enough to make it "interesting" to use (meaning, too small a
critical mass of users). I used MailSafe to secure some files, but
never found anyone I wanted to communicate with who also had it. I
even put "RSA MailSafe public key available" in my .signature for a
while, but had no takers. This is in contrast to PGP, where about half
the folks I correspond with use it, or at least have the capability to
use it.

This is why PGP has become the de facto standard for "hackers" and
other amateurs (meaning, non-corporate users...and maybe a few folks
in corporations).

It seems to many of us that RSA Data Security is _helped_ by this
situation with PGP. Yes, _helped_. Tens of thousands of users of PGP
are grappling with the issues, learning the methods of RSA digital
signatures and encryption, and are generally getting used to the idea
of protecting their own mail and files.

These PGP users are potential customers of future RSA Data Security
products, either at their companies or, if priced reasonably and
supported by RSA, for their own use.

Furthermore, the existence of PGP and the rapid rate at which it is
evolving (the latest release, 2.1, adds significant new features) is
in stark contrast to the moribund MailSafe, which apparently has not
changed since 1988. RSA Data Security may not like this "competition,"
but it may serve to light a fire under them to upgrade their end-user
products.

(I suppose RSA feels compelled to do something to protect their patent
position, lest it be jeopardized by their inaction.)

I haven't said anything about the various licensing deals with Lotus
Notes, Apple, DEC, IBM, etc. These deals suggest RSA's technology is
about to become widespread amongst corporate users, which is all to
the good. (Provided there is no crippling of the security...I did hear
a report that Apple's "Open Collaboration..." product may be forced to
use a reduced-security version of RSA. If true, this is bad news.)

Finally, another positive word about RSA Data Security. A year ago
they sponsored a wonderful one-day free conference, in Redwood Shores,
CA.  That conference thoroughly trashed the government's proposed
"Digital Signature Standard" (DSS), and helped mobilize the backlash
against it. RSA stood to gain from this repudiation of DSS, but the
conference was still very useful in illuminating the main problems
with DSS.

This year the conference is 2 days, January 14th and 15th. Call
415-595-8782 for details (but hurry, as I hear it is filling up fast).

Granted, they are pushing their products. But this is also a service
to the overall crypto community, and for that we should be
appreciative.

Just thought I'd find something nice to say about RSA Data Security.

---Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^756839 | PGP Public Key: by arrangement.