You are on page 1of 5


0 Strict//EN"
<html xmlns="" lang="en" xml:lang="en">
<title>EFF: </title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

<link rel="stylesheet" type="text/css"

<link rel="stylesheet" type="text/css"
<link rel="stylesheet"
href="" type="text/css"
media="screen" id="narrow" title="narrow" />
<link rel="alternate stylesheet"
href="" type="text/css"
media="screen" id="wide" title="wide" />
<script src=""
<link rel="alternate" type="application/rss+xml" title="EFF - Deeplinks"
href="" />
<link rel="alternate" type="application/rss+xml" title="EFF - Press Releases"
href="" />
<link rel="alternate" type="application/rss+xml" title="EFF - Action Alerts"
href="" />
<link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
<script type="text/javascript">

window.onresize = doOnResize;
window.onload = doOnLoad;



<div class="wrapper">
<div id="header">
<div id="headerinner">
<div id="search"><div id="searchinner">
<form method="get" action="/cgi/">
<input class="searchtextarea" type="text" name="q" size="15" maxlength="255"
value="Enter search terms" onclick="this.value = ''" /> <input type="submit"
class="submit" value="Search EFF" name="sa" /> <a class="searchinfolink"
<a id="logo" href="/"><img
alt="Electronic Frontier Foundation" width="442" height="66" border="0" /></a>
</div><div id="topnav">
<div class="wrapper">
<ul class="links-menu">
<li><a href="" class=" first">About</a></li>
<li><a href="">Our Work</a></li>
<li><a href="">Deeplinks Blog</a></li>
<li><a href="">Press Room</a></li>
<li><a href="">Take Action</a></li>
<li><a href="" class=" last">Join EFF</a></li>
</div><div class="wrapper">
<div id="content" class="withoutsidebar">
<div class="breadcrumb">
<a href="">Home</a> &raquo; <a href="/Privacy/">Privacy</a>
&raquo; <a href="/Privacy/Crypto/">Crypto</a><span
<!-- conditional navbars -->
<div class="clr"></div>

<div id="featuretext">


Here's a short piece from Scientific American on RSA, PEM, PGP etc.

Notice towards the end this article says "The U.S. is the only nation
that permits the patenting of mathematical algorithms."

That threw me at first -- it's not *supposed* to be permitted, but in

practice, it is. So I suppose this is a true statement.

(The cover article of this Sci Am is on a team at the Science Museum in

London that did a 3-ton implementation of Babbage's Difference Engine.)

-- strick

Source: Scientific American, February 1993, beginning at the 30th page.

For fair use only.

Electronic Envelopes?
The uncertainty of keeping e-mail private

Recent legislative efforts to mandate remote wiretapping attachments

for every telephone system and computer network in the U.S. may have
been the best thing that every happened for encryption software. "We
have mostly the FBI to thank," says John Gilmore of Cygnus Support in
Palo Alto, Calif. Gilmore is an entrepreneur, hacker and electronic
civil libertarian who helped to found the Electronic Frontier
Foundation (EFF). He is now watching closely the development of two
competing techniques for keeping electronic mail private.

As matters now stand, computers transmit messages from one user to

another in plain text. If a geneticist in Boston sends e-mail to a
molecular biologist in San Diego, any of the half a dozen or so
intermediary machines that forward the letter could siphon off a copy
-- and so could any of the dozens of workstations that might be
attached to the local-area network at the sender's or recipient's
university or company.

The Electronic Privacy Act of 1986 prohibits snooping by public

e-mail carriers or law-enforcement officials, except by court order.
Nevertheless, many people are becoming uncomfortable with the
electronic equivalent of mailing all their correspondence on postcards
and relying on people to refrain from reading it. They are turning to
public-key encryption, which allows anyone to encode a message but only
the recipient to decode it. Each user has a public key, which is made
widely available, and a closely guarded secret key. Messages encrypted
with one key can be decrypted only with each other, thus also making it
possible to "sign" messages by encrypting them with the private key
[see "Achieving Electronic Privacy," by David Chaum; Scientific
American, August 1992].

Two programs -- and two almost diametrically opposed viewpoints

embodied in them -- are competing for acceptance. Privacy Enhanced
Mail (PEM) is the long-awaited culmination of years of international
standard setting by computer scientists. Pretty Good Privacy (PGP) is
a possibly illegal work of "guerilla freeware" originally written by
software consultant Philip Zimmermann.

The philosophies of PEM and PGP differ most visibly with respect to
key management, the crucial task of ensuring that the public keys that
encode messages actually belong to the intended recipient rather than a
malevolent third party. PEM relies on a rigid hierarchy of trusted
companies, universities and other institutions to certify public keys,
which are then stored on a "key server" accessible over the Internet.
To send private mail, one asks the key server for the public key of the
addressee, which has been signed by the appropriate certification
authorities. PGP, in contrast, operates on what Zimmermann calls "a
web of trust": people who wish to correspond privately can exchange
keys directly or through trusted intermediaries. The intermediaries
sign the keys that they pass on, thus certifying their authenticity.

PGP's decentralized approach has gained a wide following since its

initial release in June 1991, according to Hugh E. Miller of Loyola
University in Chicago, who maintains an electronic mailing list for
discussion among PGP users. His personal "keyring" file contains
public keys for about 100 correspondents, and others have keyrings
containing far more. As of the end of 1992, meanwhile, a final version
of PEM has not been officially released. Gilmore, who subscribes to
the electronic mailing list for PEM developers, says he has seen "only
five or 10" messages actually encrypted using the software.

Although PGP's purchase price is right -- it is freely available over

the Internet and on electronic bulletin boards throughout the world --
it does carry two liabilities that could frighten away potential
users. First, U.S. law defines cryptographic hardware and software as
"munitions." So anyone who is caught making a copy of the program could
run afoul of export-control laws. Miller calls this situation
"absurd," citing the availability of high-quality cryptographic
software on the streets of Moscow.
Worse yet, RSA Data Security in Redwood City, Calif., holds rights to
a U.S. patent on the public-key encryption algorithm, and D. James
Bidzos, the company's president, asserts that anyone using or
distributing PGP could be sued for infringement. The company has
licensed public-key software to corporations and sells its own
encrypted-mail package (the algorithm was developed with federal
support, and so the government has a royalty-free license). When
Bidzos's attorneys warned Zimmermann that he faced a suit for
developing PGP, he gave up further work on the program.

Instead PGP's ongoing improvements are in the hands of an

international team of software developers who take advice from
Zimmermann by e-mail. The U.S. is the only nation that permits the
patenting of mathematical algorithms, and so programmers in the
Netherlands or New Zealand apparently have little to fear.

U.S. residents who import the program could still face legal action,
although repeated warnings broadcast in cryptography discussion groups
on computer networks have yet to be superseded by legal filings.
Meanwhile, Gilmore says, the only substantive effect of the patent
threat is that development and use of cryptographic tools have been
driven out of the U.S. into less restrictive countries

-- Paul Wallich




<!-- footer -->

<div id="footer">
<div class="wrapper">
<div id="footerinner">
<div id="cc">
<a href=""><img
alt="Creative Commons Licensed" width="22" height="23" border="0" /></a>
<div id="footernav">
<ul class="links-menu">
<li><a href="" title="Thanks" class="
<li><a href="" title="RSS Feeds">RSS Feeds</a></li>
<li><a href="" title="Privacy Policy">Privacy
<li><a href="" title="Contact EFF" class="
last">Contact EFF</a></li>
<div class="clr"></div>