Subject: Do people have something against RSA?

From: "Christopher Williams" <[email-masked]>
Date: Fri, 16 Jun 2000 12:22:59 +0100

Do people in the PKI world have something RSA Data Corporation?  It's just
that every document mandates DSA as a signature algorithm and indicates that
RSA "MAY" also be supported.  Another example is that PKIX does not support
PKCS#8 for securing private keys, even though PKCS#8 is a well-established
standard (eight years old now?).  Then I read as a suggested amendment to
the TSP document:

"TSA implementations MUST support DSA.  TSA implementations MAY include RSA.
"

Get real!  The whole world uses RSA.  The future worldwide PKI will run on
RSA.  I have never seen a certificate signed with an algorithm other than
RSA and containing anything other than an RSA public key.  Sure, RSA is
patented, so factor licensing it as part of your software development costs
and pay them their fee - they deserve it.

Insisting upon DSA and Diffie-Hellman is like railing against the
universality of Microsoft: pointless and missing the point.

Christopher Williams

Software engineer, NetLexis Ltd.
http://www.netlexis.com "Intelligent Trust"

---

From: Ben Laurie <[email-masked]>
Date: Fri, 16 Jun 2000 12:51:14 +0100

> universality of Microsoft: pointless and missing the point.

IETF standards are required to use non-proprietary technologies wherever
possible.

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

Coming to ApacheCon Europe 2000? http://apachecon.com/

---

From: <[email-masked]>
Date: Fri, 16 Jun 2000 14:24:04 +0200

> > Get real!  The whole world uses RSA. [...]

Yes, but - the RSA patent is going to expire in September this year, is it
not?

There are not going to be any serious commercial employments of, say, a TSA,
before September, are they?

So why not put in RSA, since the patent is going to expire soon enough
anyway? As far as I know, the validity of the patent cannot be extended,
thus RSA becomes public domain.

Regards,

denis

---

From: Ben Laurie <[email-masked]>
Date: Fri, 16 Jun 2000 15:20:45 +0100

> before September, are they?

Rules are rules! In September, you'll be right.

Cheers,

Ben.

---

From: Timothy Fisher <[email-masked]>
Date: Fri, 16 Jun 2000 10:17:05 -0400

Fortunately, the patent will expire at the end of September of this year.  After
that, you will
no longer have to pay RSA data corp. any fees to use RSA.

The reason that DSA is mandated in most standards is simply because it is free
to use.
A standard should never mandate an algorithm which must be licensed from a
specific provider.
This would be a mistake.

Timothy Fisher

---

From: Timothy Fisher <[email-masked]>
Date: Fri, 16 Jun 2000 10:18:55 -0400

Chris,

I also think that the simple fact is that YES, quite a few people do have
something against RSA
Security Inc.   Have you ever tryed negotiating with them?   I have...   Its not a
fun process....
Many people share this opinion of RSA.

Tim

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 16 Jun 2000 16:50:58 +0200

denis,

I will use your E-mail to comment.
 
> before September, are they?

I do not buy the arguments from Christopher, but I thank him for
being the first one daring to raise the issue. The question raised
by denis makes sense: we only have a little bit more than 3 months
left before the expiration of the RSA patent.

There are two related questions:

1) Should we mandate the use of the RSA algorithm for signing TS
token ? This seems reasonable in this new context.
2) Should the chairs wait until September 21 rst, 2000 to send the
TSP draft to the IESG (and mandate the use of the RSA algorithm for
signing) or should they do it now (i.e. as soon as they consider
that we have reached a WG consensus) taking into account that the
next step is Proposed Standard, i.e. not Standard, which means that
in any case, the Standard will be published three months AFTER the
expiration of the RSA patent. 

The later seems reasonable ... but would mean to publish a version 9
of the TSP draft before sending it to the IESG.

Anyway the question is much broader than the TSP draft and applies
to all other drafts, in particular Attibute Certificates.

Denis

---

From: Michael Sierchio <[email-masked]>
Date: Fri, 16 Jun 2000 08:20:48 -0700

Christopher Williams wrote:
> "TSA implementations MUST support DSA.  TSA implementations MAY include RSA."

I'm afraid that I don't see why a mandate for private key storage is
relevant to this discussion -- other than the obvious requirement
that private keys be kept private,  whether by embedding in tamper-resistant
hardware,  password based encryption, etc.,  and that there be a revocation
mechanism in the event of compromise.

And the answer to your query -- as a former employee of RSADSI (now
RSA Security) -- is: yes.  There is antipathy for RSA, perhaps because
they have always spent more on lawyers than on R&D.  I have the greatest
respect for the folks at RSA Labs,  but slight regard for the rest of
the company that was RSADSI and SDTI.

> RSA.

One might easily surmise that the future of PKI is ECC, or something
yet to be invented.  However,  choosing technology that is unecumbered
by patents is an IETF requirement.

>  I have never seen a certificate signed with an algorithm other than
> RSA and containing anything other than an RSA public key. 

That is a self-referential statement -- the plural of anecdote is not
data, IIRC.

> universality of Microsoft: pointless and missing the point.

There are distinct advantages to the use of long-term DH values
tied to identity, esp. when it comes to stateless protocols, IPSec,
and other uses for key agreement.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 16 Jun 2000 11:55:55 -0400

Denis,

The TSP draft is well along and I don't envision holding it up, 
waiting for the RSA patent to expire.  The document adopted an 
algorithm approach consistent with IESG policy, and with other 
crypto-based RFCs.  Let's just stick with that.

Steve