From: wcs@anchor.ho.att.com (bill.stewart@pleasantonca.ncr.com +1-510-484-6204)
Date: Fri, 2 Dec 94 22:39:38 PST
To: tomaz@cmir.arnes.si
Subject: Re:  using us crypto sw outside usa
Message-ID: <9412022104.AA11526@anchor.ho.att.com>
MIME-Version: 1.0
Content-Type: text/plain


> I was wondering what is the legal status for using rsaref ooutside usa.
> Is it legal or not?

There are three problems - getting a copy, patent, and copyright.

Getting a copy of RSAREF means that somebody has to export it,
which the US government strongly disapproves of.
On the other hand, if you're not a US citizen, and not in the US,
and your government doesn't have laws against possessing things
that other governments don't want you to have, no problem.

Patent - the RSA algorithm patent doesn't apply outside the US, 
so no problem.

Copyright - Most governments do honor U.S. copyrights.
Some of the early RSAREF versions said that you may not export it,
so there may be copyright problems if you use them outside the US.
Newer versions have a warning that the US government doesn't permit
export, and recommends talking to a lawyer if this affects you,
but doesn't say that you may not do so - so there isn't a problem
with permission, and therefore not with copyright.

That's nice, because otherwise I would have had to pay somebody
outside North America to write a clone.  (I had offered anybody on 
the net outside the US/Canada $100 to do so, but nobody took it,
and I now cancel that offer because RSA doesn't forbid overseas use
and copies have apparently gotten distributed.)

> Also, what is the legal status of RC4 code posted to the net?

Uncertain.  It was protected by trade secret (not giving anybody
copies unless they sign a license contract), but somebody
apparently violated their contract and disclosed it anyway.
Some places have laws against using information released like that,
some don't, some allow the originator of the information to sue.
There's also the problem of verifying whether that *really* is RC4.

		Bill Stewart