Subject: Re: quickly find what applications are affected by RSA
To: None <current-users@netbsd.org>
From: Thor Lancelot Simon <tls@rek.tjls.com>
List: current-users
Date: 09/08/2000 11:58:48
On Fri, Sep 08, 2000 at 09:44:28AM -0500, Frederick Bruckman wrote:
>
> > 	- other patented algorithms, like IDEA/RC4/RC5
> 
> I wasn't aware that the algorithms were patented. Are you saying that
> the openssl distribution in the NetBSD sources violates some patent?

No, he is not.  Why?  Because at the same time that we removed RSA, we
removed all other algorithms we knew to be subject to intellectual property
claims.  RC5 is patented by Rivest and the patent is assigned to RSADSI.  
IDEA is patented by Ascom Tech and a fee is charged for commercial use.  RC4
isn't patented -- the name "RC4" is trademarked and it is RSADSI's claim that
the actual "RC4" algorithm is a trade secret.  However, an algorithm which
obviously interoperates with RC4 has been widely published for years; we
should probably rightly call it "arcfour" even though it's pretty unlikely
IMHO (I am *not* a lawyer) that RSADSI could ever prevail on a trademark
infringement claim based on the name of a function in a library!

Anyway, the OpenSSL in our tree hasn't got the stuff in it that appeared to
have intellectual property problems.  We were very careful about this.  If
you want more detail, Fredrick, you should see the commit logs and the mail
archives from the relevant point in time.

Thor