Re: use of ripem instead of pgp

[jthomas@kolanut.mitre.org (Joe Thomas)]

BRIAN MCBEE <opac!brian%OPAC.osl.or.gov@cs.orst.edu> writes:
>Since the only reason we are talking about RIPEM is because of  
legality 

>concerns about PGP, I thought I'd mention that it is (at least  
theoretically) 

>illegal to export RIPEM from the US, annd therefore could not be  
legally used 

>to correspond with persons overseas.

>I don't know if there is a legal way to do public key cryptography  
between 

>persons inside the US and persons outside the US.

What is illegal to export is the software implementations of strong  
cryptography, not messages encrypted with them, or even detailed  
specifications of how to implement compatible software.  So,  
theoretically, if a group in each COCOM-complying country and a group  
out of the reach of COCOM each independently implemented software to  
do the public-key cryptography (the U.S. group is the only one that  
will have to worry about licensing PKP's patents), then trading  
encrypted mail would be unquestionably legal.

It would also be a lot of wasted work and duplicated effort, and I  
don't see any reason to respect the laws that make exporting or  
importing this software illegal.  RIPEM has no doubt escaped the U.S.  
since RSADSI put it up for anonymous FTP last week, and PGP is  
everywhere.

Joe