Subject: Re: OpenSSL import
To: None <tech-security@netbsd.org, netbsd-intl@sandelman.ottawa.on.ca>
From: Michael C. Richardson <mcr@sandelman.ottawa.on.ca>
List: tech-security
Date: 06/29/1999 22:00:33
>>>>> "Thor" == Thor Lancelot Simon <tls@rek.tjls.com> writes:
Thor> On Tue, Jun 29, 1999 at 08:41:31PM -0400, Michael C. Richardson
Thor> wrote:
>> What else should I remove? From comments on the list, I take it that
>> rc2, rc4, rc5, rsa has to go. Anything else?
Thor> That is certainly not my position.
Thor> I would personally be quite happy if you left the current
Thor> structure, minus code that has patent or other IP issues. I
You mean like RSA.
Thor> personally think that leaving the RSA code in cryptosrc-intl is a
Thor> good idea, so long as building it can be disabled. I see no
But, it has patent issues.
Thor> problem with having an OpenSSL distribution, minus the code that
Thor> has known intellectual property issues, in cryptosrc-intl/dist,
Thor> with reach-across makefiles. Clearly nothing has to reach into the
Thor> MD5 or SHA1 subdirectories and duplicate what's already in libc in
Thor> the built libraries.
Thor> To my knowledge, the code that has intellectual property problems
Thor> is:
Thor> * IDEA (Ascom patents) * MD2 (license does not permit use except
Thor> with a certain mail package) * RC4 (fine *if you don't call it
Thor> RC4*; a trademark issue) * RC5 (U.S. patent issued, int'l patents
Thor> pending AFAICT) * RC2 (trademark issue, as with RC4)
And, until 2000, RSA.
:!mcr!: | Cow#1: Are you worried about getting Mad Cow Disease?
Michael Richardson | Cow#2: No. I'm a duck.
Home: mcr@sandelman.ottawa.on.ca. PGP key available.