[2266] in Kerberos
Re: Kerberos DES <> MD5
daemon@ATHENA.MIT.EDU (Charlie Kaufman)
Wed Oct 7 15:10:20 1992
Date: Wed, 7 Oct 92 14:42:01 EDT
From: Charlie Kaufman <kaufman@kibitz.enet.dec.com>
To: netmgr@tellus.csc.fi, alan@curta.cc.columbia.edu
Cc: kerberos@Athena.MIT.EDU, kaufman@kibitz.enet.dec.com
Apparently-To: netmgr@tellus.csc.fi, alan@curta.cc.columbia.edu,
>I believe that MD5 is patented by RSADSI in the US of A. It may be used
>only under license from RSADSI in this country.
MD5 may or may not be patented, but in any case RSADSI has made it
freely useable without payment of royalties (unlike the RSA algorithm
itself). The notice in the model code in RFC 1321 includes the following text:
-----
Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All rights
reserved.
License to copy and use this software is granted provided that it
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
Algorithm" in all material mentioning or referencing this software
or this function.
License is also granted to make and use derivative works provided
that such works are identified as "derived from the RSA Data
Security, Inc. MD5 Message-Digest Algorithm" in all material
mentioning or referencing the derived work.
-----
>Besides, any crypto technology is
>restricted from export. So, an export license would be necessary for RSA
>just as it is for DES and a Captain Midnite Decoder Ring.
Sadly, this part of the message is correct. There is a misconception
that encryption based on MD5 would be easier to export than encryption
based on DES. This is *probably* not true (never make any absolute
statement about export).
Encryption used for data integrity protection (either via DES or MD5)
is easier to license for export than encryption used for data privacy.
But if you use MD5 for data privacy (which is possible but
cryptographically unproven), you're in the same soup.
It is possible to remove encryption for privacy from Kerberos and get a
fairly general export license. Digital has done so with Kerberos V4.
Unfortunately, that is not the same as freely distributable and - at
least in our case - part of the price was not distributing source code.
It did not require removal of DES.
--Charlie
-------------------------------------------------
Email: kaufman@dsmail.enet.dec.com Paper: Charles Kaufman
Phone: 1-508-486-7329 Digital Equipment Corporation
FAX: 1-508-486-5279 550 King Street, LKG1-2/A19
Littleton, MA 01460
