## Table of Contents

    A few of my random thoughts about what I currently know with regards
    to restrictions on the use of SSLeay due to software patents and US
    cryptographic export restrictions.

    Seth Robertson <seth@soscorp.com> and david d `zoo' zuhn
    <zoo@armadillo.com>
    have been very helpful in the preparation of this file.

    First up, my library is FREE for COMMERCIAL and non-commercial use.
    I
    make no money from people using the algorithms encoded in this
    library. (But I would accept donations :-).  I live in Australia and
    if there are any cryptographic export restrictions, all I can say is
    that I
    have had available for anon-ftp crypto routines for nearly 4 years
    and
    no government type person has ever mentioned a thing.

    All code in this library was written by me and I have never seen
    SSLref
    or RSAref.

    DES.  I have my libdes DES library in this packages.  I wrote it from
    documentation in the University of Queensland library.  My library is
    actually used in SSLref (so I have been told).  I find it 'cute' that
    it appears that most SSL implementation may end up using a
    DES encryption library from Australia :-).  People from the USA
    are not allowed to export DES due to crypto export restrictions.
    It can go in but not out.

    RC4.  I have RSA's RC4 cipher in my SSL packages.  I implemented it
    from source code found on a ftp site in Europe.  I am not sure of the
    legal status of people in the USA using it since I think RSA are not
    very happy about it being reverse engineered.  I assume that RSA's
    implementation is Copyrighted and is a Trade Secret, but that should
    not effect this implementation since it was not derived from RSA's
    actual source.  So, it may be illegal to use in the USA but I don't
    know.  Export is definitely a no no.

    IDEA.  The IDEA algorithm can be used in the SSL protocol and as of
    version 0.4.2 of my library it is present.  I believe it needs
    to be licensed for businesses in Europe due to software patents but
    am not sure how they are 'enforcing' the licenceing.

    RSA.  Ah, the big one.
    The following is taken from the "The SSL Protocol" as published by
    Netscape.
            The Massachusetts Institute of Technology and the Board of
            Trustees of the Leland Stanford Junior University have
    granted
            Public Key Partners (PKP) exclusive sub-licensing rights to
            the following patents issued in the United States, and all of
            their corresponding foreign patents:

            Cryptographic Apparatus and Method
            ("Diffie-Hellman")                      No. 4,200,770
            Public Key Cryptographic Apparatus and Method
            ("Hellman-Merkle")                      No. 4,318,582
            Cryptographic Communications System and Method
            ("RSA")                                 No. 4,405,829
            Exponential Cryptographic Apparatus and Method
            ("Hellman-Pohlig")                      No. 4,424,414

            These patents are stated by PKP to cover all known methods of
            practicing the are of Public Key encryption, including the
            variations collectively known as El Gamal.

            Public Key partners has provided written assurance to the
            Internet Society that parties will be able to obtain, under
            reasonable, nondiscriminatory terms, the right to use the
            technology covered by these patents.
            ......

    From my understanding, it is therefor required that US people must
    get a license from PKP to use SSLeay.  People outside the USA can
    use it
    as much as the like since I don't think the US software patents are
    valid outside of the US.  My implementation has been written from
    books on algorithms which include sections on number theory.  I
    basically knew zip about RSA stuff before I started reading at the
    start of April'95.  So this one is a 'no export' from the USA and
    probably
    a 'no use' in the USA.  The Diffie-Hellman routines are covered by
    the same problems.
    So we end up with a library that is free, but in the USA you must pay
    money to people who the author has never met nor spoken too,
    otherwise
    you break the law.  People can use my SSL library and the encryption
    routines (except RSA and RC4) if I make it possible to build SSLeay
    to use RSAref.  RSAref is the 'public' RSA reference implementation.
    It is limited I believe to 1024 bit private keys.  My RSA
    implementation is not (I have some sample keys of 2048, 4096 bits in
    the distribution).  RSA Inc. have another implementation of RSA in
    their
    BSAFE toolkit but it is for commercial use and costs dollars.  It is
    not limited to 1024 bit keys (I believe).  RSAref is free for
    non-commercial use under some very interesting conditions.  I have
    appended their conditions to the end of this document.

    This RSA code can probably be imported into the USA but not executed.
    Again, not for export once in the USA.

    One interesting question I have is what is the status of a binary
    program that is a SSL filter between the Internet and a local program
    (via a named pipe or UNIX domain socket);
    If I make binaries available in Australia, will people who ftp it to
    the USA for free then have to pay PKP to run the program?  I could
    just call it 'securelink' and not tell them the 'secret' encryption
    algorithm I use.  Would they then be able to be prosecuted for
    violating
    a patent they don't know is being violated?

    A few more points for people in the USA regarding putting hooks in
    their
    code to use SSL/RSA from my library and acquisition of a license
    from PKP (the people who own the patent) for use of the RSA
    algorithm.

    First, PKP have exclusive patent rights on all aspects of public key
    cryptography (as 'listed' above).  Part of these conditions is that
    they are reasonable and non-discriminatory in their licensing.
    Unfortunately this does not mean they have to license my
    implementation.  They have to license an implementation and they can
    put as many restrictions as they like (e.g. it cannot be modified or
    whatever).  I have not actually spoken to PKP at this point in time.
    The patent gives a limited (17 year) monopoly, which some would
    consider a very very long time in the software game.....

    One thing worth considering, there are no crypto export restrictions
    between the USA and Canada, and Canada does not have software
    patents.
    So it is legal to build and use my library in Canada if you live in
    the USA.

    Second point, the following is the X11R6/xdm-auth/README and the same
    README appears in X11R5 (I have been playing with DES for quite a few
    years :-)

      If you are looking for the file xc/lib/Xdmcp/Wraphelp.c, be
    advised that
      export of this software from the United States of America is
    assumed to
      require a specific license from the United States Government.  It
    is the
      responsibility of any person or organization contemplating export
    to obtain
      such a license before exporting.  You will find what you are
    looking for,
      in compressed form, as the file /private/xdm/help on this machine.
    Note
      that you have to cd to '/private/xdm' in one step and then 'get'
    the
      file.

      Although it sounds stupid, and it is, we would appreciate if you
    would
      only tell other people how to find this README file, and not point
    them
      directly to the actual source code, so that they will read this
    warning.

      For persons outside the US, a compatible version of this file,
    implemented
      outside the US, can be obtained by anonymous ftp to
    ftp.psy.uq.oz.au
      (130.102.32.1) in the directory /pub/X11R5/.

    So perhaps other people could get away with doing a similar thing
    with their
    code.  It could be worth talking to the X consortium if you are
    not sure about the legal implications.  For the RSA code, it may
    actually be illegal to even have code that would only work with my
    implementation.  If you wrote code that could work with either SSLref
    or my SSLeay, you should be ok.

    Anyway, enough of my rambling, none of this affects me because
    a) I'm not making any money from this so I don't need to pay anyone
    :-)
    b) I'm living in part of the world not covered by software patent.

    This information could all be wrong and out of date since alot of
    this
    stuff seems to be changing daily, so these are some of my off the
    cuff
    thoughts on the topic as of December 1995.

    eric

    Oh yes, I believe the laws in France are as follows:
    Crypto code is considered munitions, much as in the USA.
    The use of crypto stuff is illegal unless it is properly authorized.
    Authorization of serious crypto stuff like PGP is impossible.
    So if the use of PGP is illegal so is my library (I have the same
    algorithms plus more, in library and program form).  So if you are in
    France you are not even supposed to import this library.

    ====
    What follow is what I believe to be the license for RSAref.
    The second part of item 1. is interesting.  It appears that these are
    be the only conditions that free public key applications can be used
    in the
    USA.  My free library will probably not change this.
    --
    >WHAT YOU CAN (AND CANNOT) DO WITH RSAREF
    >
    >     1.   RSAREF is free for personal or corporate use under the
    >          following conditions:
    >
    >          o    RSAREF, RSAREF applications, and services based on
    >               RSAREF applications may not be sold.
    >
    >          o    You must give RSA the source code of any free RSAREF
    >               application you plan to distribute or deploy within
    >               your company. RSA will make these applications
    >               available to the public, free of charge.
    >     2.   RSAREF applications and services based on RSAREF
    >          applications may be sold under the following conditions:
    >
    >          o    You must sign and return the RSAREF Commercial
    License
    >               Agreement to RSA (call RSA for a copy of this
    >               agreement). Remember, RSAREF is an unsupported
    toolkit.
    >               If you are building an application to sell, you
    should
    >               consider using fully supported libraries like RSA's
    >               BSAFE or TIPEM SDK's.
    >
    >     3.   RSAREF applications and services based on RSAREF
    >          applications may be "sharewared" under the following
    >          conditions:
    >
    >          o    Shareware authors do not need to sign a separate
    >               agreement with RSA, provided that their per-copy
    asking
    >               price is less than $50 and total RSAREF application
    >               revenue is less than $10,000 annually. Otherwise,
    >               shareware authors must sign and return the RSAREF
    >               Commercial License Agreement.