Subject: Re: Do people have something against RSA?

From: "Bob Jueneman" <[email-masked]>
Date: Thu, 22 Jun 2000 14:55:21 -0600

Amen, brother!

I'm still waiting to see piece of e-mail that was signed using DSA and 
validated by a signature that also uses DSA.  It isn't that it couldn't necessarily
be done, it's just that it would be such a curiosity that I would be inclined to 
frame it.

It's exactly like when all of the coin machine vendors were forced to change their 
machines to handle the Susan B. Anthony dollar, only to have that coin sink 
like a rock.  The Post Office (and only the Post Office) issued them as change
if you bought a book of stamps, and anyone who received one got rid of it at the first
opportunity.

In the meantime, mandating particular algorithms that no one uses adds very 
significantly to the cost of development, testing, and documentation, not to mention 
bloated code. And piling on additional, "standardized" optional algorithms
just makes things worse.

"The nice thing about standards is that there are so many different ones to 
choose from."

Fortunately, the various vendors are quite free to say "Nuts to that" and ignore
the political correctness nonsense, and many of them are doing so.

RSA may very well be the Lavoris of cryptography -- the mouthwash you 
love to hate, twice a day -- but their standards, including the PKCS suite 
and S/MIME (along with Netscape's SSL, for all of its warts) have been 
commercial successes, while the adoption of IETF standards in this space 
have been lukewarm at best.  And they (along with Phil Zimmerman) were the ones 
who were standing up to NSA and refusing to back down when the 
government wanted desperately to put the crypto genie back in the bottle.

I'm glad that patents don't last forever, but we shouldn't begrudge them a 
reasonable return on their hard work.

Bob

>>> "Christopher Williams" <[email-masked]> 06/16/00 11:35AM >>>
OK, maybe RSADSI are litigious and awkward to deal with.  I don't know, I've
never dealt with them.  However, let's say that I implemented a standard,
say TLS, and only included the mandatory cipher suite, DSA with ephemeral
Diffie-Hellman, SHA-1 and 3-DES encryption.  You know what?  It wouldn't
work with anything!  Everybody else's implementation uses RSA so mine has to
as well, whether I like it or not.  The reality is that RSA is mandatory and
DSA the nice optional extra which adds spice and competitive advantage.

As to whether the future belongs to RSA or maybe some recent innovation like
ECC or some as-yet uninvented scheme, as Microsoft shows, it's not being the
best that makes you the winner, it's being the most widespread.

So, given that:
 - RSA's patent is due to expire (news to me, but welcome news)
 - DSA has patent issues in Europe
 - Everybody uses RSA anyway; very few use DSA

Can we please start mandating RSA in future?  It will make implementing
standards much easier and remove the FUD because I haven't incorporated
support for Diffie-Hellman!

Christopher Williams

Software engineer, NetLexis Ltd.
http://www.netlexis.com "Intelligent Trust"

---

From: "Peter Lipp" <[email-masked]>
Date: Thu, 22 Jun 2000 23:13:31 +0200

Bob,

> I'm still waiting to see piece of e-mail that was signed using DSA
> and  validated by a signature that also uses DSA.  It isn't that it
> couldn't necessarily
You did not insist on S/Mime, did you? :-)

Peter

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 22 Jun 2000 15:27:16 -0700

At 2:55 PM -0600 6/22/00, Bob Jueneman wrote:
>validated by a signature that also uses DSA.

Start using PGP.

>reasonable return on their hard work.

It's funny how we never hear things like this from anyone who doesn't 
work for a large company.

--Paul Hoffman, Director
--Internet Mail Consortium