NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/sci/crypt/6208

Internet Message Format | 1992-12-27 | 5.4 KB

Xref: sparky sci.crypt:6208 alt.security.pgp:434 misc.legal:21748
Path: sparky!uunet!cs.utexas.edu!rutgers!igor.rutgers.edu!zodiac.rutgers.edu!leichter
From: [e-mail]
Newsgroups: sci.crypt,alt.security.pgp,misc.legal
Subject: Re: PGP use Ethical and Legal Questions
Message-ID: <[e-mail]>
Date: 27 Dec 92 14:41:05 GMT
References: <[e-mail]>
Sender: [e-mail]
Followup-To: sci.crypt
Organization: Rutgers University Department of Computer Science
Lines: 96
Nntp-Posting-Host: pisces.rutgers.edu

In article <[e-mail]>, [e-mail]
(james.a.parker) writes:

You know, there's only so much nonsense one can put up with.

> David Sternlight seems to be on a one man crusade to eliminate the use of PGP.
> He has argued that it is both illegal and unethical to do so, on the basis of:
>
>    o ITAR restrictions against US import
>    o Patents held by PKP
>
> Let me address each of these.
>
> IS IT LEGAL?
>
> With respect to the patents held by PKP, it is alleged that PGP infringes upon
> the intellectual property rights of PKP.  However, this is the case only if
> the patents are indeed being infringed.  This has not been demonstrated,
> however.  The claim apparantly made by PKP is that it holds sole ownership
> of all implementation of public key cryptosystems.  This seems a rather broad
> claim, and one which could certainly be attacked on the basis of its being
> overly broad and/or an "obvious" act of someone skilled in the appropriate
> art

Really.  Can you then explain why, when Diffie and Hellman came up with public
key cryptography, their work was published by high-quality peer-refereed
journals?  Why their peers considered this an important piece of work?  Why
even Scientific American thought it interesting and novel enough to publish
an article on it?

And just how many papers on cryptography have *you* published in peer-reviewed
journals.?  Just how many of your papers have received, oh, 10% of the cita-
tions that Diffie and Hellman have received?

Just because you can understand something AFTER someone else has invented it
and explained it to you doesn't make it obvious.  Frankly, I see nothing to
make me believe that you are competent to comment on this issue.  Just what
interesting cryptographic ideas did *you* publish in the late '70's?

>      (the trick being *how* to do it; RSA being one effective way).

You are not competent to comment on what "the trick" might or might not be.
Even if you were, you will not that PKP holds the licenses to the RSA patent
as well.

(FWIW, the closest thing to public-key cryptography published before Diffie
and Hellman that I know of is a clever paper on "puzzles" by Ralph Merkle.
While clearly a step in a similar direction, it neither proposed a general
public key model, nor developed a workable, secure scheme:  The difference
in work factor for the receiver and an eavesdropper was linear.  I know I
spent a fair amount of time trying to improve that - and I'm sure Merkle
spent much more time, as probably others did, too.  But this turned out to be
a dead-end.  What was needed was an entirely different approach, which is
what Diffie and Hellman found.)

>
> In addition, PKP has apparently not attempted to defend its patent against
> PGP (although they know of its existence); this gives some merit to the theory
> that PKP *knows* it has no legal standing.

Bullshit.  Neither PKP nor anyone can "know" whether the patent is valid, but
I have yet to see a reasonable argument, here or elsewhere, that it is NOT
valid.  The fact that a bunch of second-rate hacks congratulating each other
on their ability, 15 years after the fact, to code up ideas that their betters
invented, seem to believe that had THEY been there they could have done the
same thing, proves nothing.

Besides, your claim is false:  PKP HAS defended its patent, as a recent
message here from someone who was a target of such a defense made clear.
The fact that no defense of the patent has ever gone to trial is mainly the
result of the high cost of such a trial to everyone concerned.  So far as I
can tell, everyone who PKP has challenged has folded WITHOUT going to trial.

>
> The answer at this point, then, is it is unknown.  Unless and until the matter
> is adjudicated in a court of law, the legal status is not known.

>
> With respect for ITAR, there is strong evidence that the restriction is not
> legally binding.  The case can be made on constitutional grounds:
>
> [Constitutional theories omitted]

There's really no point in looking at the details since they have NOTHING to
do with the issue being argued.  You don't understand how the legal system
works.  Until such time as the patent or the ITAR is ruled unconstitutional,
they ARE the law.  Laws are not "invalid until ruled valid", whatever list of
objections you may have to them.  They are "valid until ruled invalid".  Most
invalidations of laws on constitutional grounds are NOT retroactive; even when
they are, those convicted earlier can't effectively recover what they've lost.
A ruling that a patent is invalid doesn't invalidate previous voluntary
agreements to, for example, stop producing a competing product, and whoever
entered into that agreement has to eat the resulting loses.  (Yes, there can
certainly be exceptions, such as fraud; and I think an agreement to pay
royalties is dissolved if the patent disappears.  But the money already paid
is probably gone.)