From: Alex Tang <altitude@umich.edu>
Date: Wed, 26 Jul 95 13:35:11 PDT
To: rross@sci.dixie.edu (Russell Ross)
Subject: Re: RC4
In-Reply-To: <v01520d05ac3c5174f88c@[144.38.16.209]>
Message-ID: <199507262034.QAA18609@petrified.cic.net>
MIME-Version: 1.0
Content-Type: text/plain


On Wed Jul 26 16:09:38 1995: you scribbled...
> 
> >Ask them about the free version of RC4 which is circulating.  If they say
> >it is patented ask them for the patent number.  Ask them why you should
> >pay them big bucks if you can get it for free.
> 
> Here's their reply to a similar correspondence:
> 
> >The RC4 algorithm is copyrighted by and intellectual property of RSA Data
> >Security.  For use of this algorithm in a product or service you plan to
> >sell, you may use the RC4 software implementation from our BSAFE toolkit.
> >Licenses are not available for other commercial software implementations of
> >this algorithm other than what is included in our BSAFE toolkit.
> 
> I wasn't aware that you could copyright an algorithm.  Patent, yes, but not
> copyright.  Intellectual property meens secret, right?  Aren't there any
> precendence cases involving propriety schemes that are reverse engineered?
> I know there have been, I just can't remember what they are.  In any case,
> RSADSI is likely to sue anyone who attempts to use the RC4 code openly, and
> even if they lose there are considerable legal fees involved for whoever
> tries it.  What if a bunch of people put secure HTTPd servers online at the
> same time, without any clear trail pointing to the first one?  If the RC4
> code really is legal to use, this would make it hard for RSADSI to pinpoint
> anyone to sue, thus eliminating the intimidation factor.

So, does anyone know for certain if this is the true letter of the law?
Since RC4 has been reverse engineered (or leaked) to the public, do they
have any claim on it if there is no patent?  Seeing the legal web that
surrounds a lot of the current crypto situation in the US, it's not
surprising that RSA would try to smoke screen everyone into thinking that
there would be a clear violation (prosecutable by law) if anyone used RC4
without getting a license.  (It's also not surprising that no one's tried
as well...)

...alex... 

     Alex Tang  altitude@cic.net   http://petrified.cic.net/~altitude
   CICNet: Unix Support / InfoSystems Services / WebMaster / Programmer
       Viz-It!: Software Developer (Check out http://vizit.cic.net)
  UM-ITD: TaX.500 Developer (Check out http://petrified.cic.net/tax500)