Legal Issues Patents Prior to June 8, 1995, the day the US ratified the international GATT patent treaty, patents expired 17 years after the date of issue. This resulted in some odd "suspended animation" situations, where patents were not issued until long after filing. For outstanidng patents on that date, the expiration is 17 years after issue, or 20 years after filing, whichever is later. For new patents, the expiration is 20 years after filing. Information on specific patents, mostly cribbed from From www.rsasecurity.com/rsalabs/faq -------- DES U.S. Patent: 3,962,539 Filed: February 24, 1975 Issued: June 8, 1976 Inventors: Ehrsam et al. Assignee: IBM The Data Encryption Standard (DES) patent was assigned to IBM Corporation in 1976. After establishment of DES as a government stadard, IBM placed the patent in the public domain, offering royalty-free licenses conditional on adherence to the specifications of the standard. The patent expired in 1993. -------- Diffie-Hellman U.S. Patent: 4,200,770 Filed: September 6, 1977 Issued: April 29, 1980 Inventors: Hellman, Diffie, and Merkle Assignee: Stanford University This was the first patent covering a public-key cryptosystem. It describes Diffie-Hellman key exchange mechanism, as well as a means of authentication using Diffie-Hellman public keys. The patent expired in 1997. -------- RSA U.S. Patent: 4,405,829 Filed: December 14, 1977 Issued: September 20, 1983 Inventors: Rivest, Shamir, and Adelman Assignee: MIT The patent for the RSA algorithm, issued in 1983, was exclusively licensed to RSA Security Inc. by the Massachusetts Institute of Technology. RSA Security maintained a standard, royalty-based licensing policy that could be modified for special circumstances. In the U.S., a license was needed to ``make, use or sell'' products that included the RSA algorithm. RSA Security generally allowed free non-commercial use of the RSA algorithm for academic or university research purposes (with written permission, to protect patent rights) On September 6, 2000, RSA Security made the RSA algorithm publicly available and waived its rights to enforce the RSA patent for any development activities that include the algorithm occurring after September 6, 2000. -------- IDEA U.S. Patent: 5,214,703 Filed: January 7, 1992 Issued: May 25, 1993 Inventors: Lai and Massey Assignee: Ascom Tech AG (Switzerland) IDEA is the alternative, 128 bit block cipher used in PGP. The patent expires in 2010. -------- Elliptic curve systems Elliptic curve cryptosystems, as introduced in 1985 by Neal Koblitz and Victor Miller, have no general patents, though some newer elliptic curve algorithms and certain efficient implementation techniques may be covered by patents. The patent issue for elliptic curve cryptosystems is the opposite of that for RSA and Diffie-Hellman, where the cryptosystems themselves have patents, but efficient implementation techniques often do not. ----------------------------------------------------------------------------- ----------------------------------------------------------------------------- US import/export laws concerning cryptography Prior to 2000, export of cryptographic products was severly limited. In general, symmetric key sizes larger than 56 bits, RSA key sizes greater than 512 bits, and elliptic curve keys greater than 112 bits were considered "strong" encryption, and subject to munitions export restrictions. This was pursuant to the so-called Wassenaar Arrangement (WA) established in 1996 by a group of 33 countries including United States, Russia, Japan, Australia, and the members of the European Union. The purpose of this arrangement was to control exports of conventional weapons and sensitive dual-use (military and commercial) technology, which includes cryptographic products. The Wassenaar Arrangement controls do not apply to "intangible" products, which include downloads from the Internet. The arrangement is not a treaty or law, more a set of guidelines, and nations are free to adjust their own regulations. US restrictions were relaxed in January 2000, and cryptographic products are generally exportable except to government end-users or embargoed destinations (Cuba, Iran, Iraq, Libya, North Korea, Sudan, Syria). Export to government end users requires a license. Note that the government still has some room to exercise some clout, since it could, in theory, argue that export to a company or individual is equivalent to export to a government end user in the country in question. So you still might get questions about that code you are sending to your friends in Indonesia or Pakistan... Mainly, the change was practically motivated, since the principles were all known, good software was circulating on the internet, and foreign companies were getting the market in cryptographic products that US companies were prohibited from selling. Import into some other contries (e.g. Israel, Russia, China, Pakistan) could still get you into trouble in those countries, and possibly in the US, if the US has close ties to that country. In other words, Be careful what you send to Israel. ----------------------------------------------------------------------------- ----------------------------------------------------------------------------- The Digital Millennium Copyright Act (DMCA) Written partly in response to WIPO - the World Intellectual Property Organization Copyright Treaty. Signed into Law on Oct 28, 1998 Large bill (100 pages) designed to update copyright laws to make them applicable to new electronic and digital modes of expression. Contains Section 1201, on "Copyright protection and Management Systems" This makes it a crime to circumvent any copy protection technology, or provide technology or equipment for doing so. There is an interesting "anti-microsoft" exception that let you reverse engineer computer programs in order to interface new programs. Another exception lets you circumvent program technology that spies on you (another anti-microsoft inclusion) There seem to be exceptions for "legitimate" research. EFF points out that the exception might be meaningless, because the tools required to perform such research might be illegal to produce (at least commercially) and therefor effectively unavailable. 1201 also prohibits manufacture and trade in video recording equipment that does not conform to certain broadcast copy prevention technology. (gain control, colorstripe, 4-color-stripe) copy control technology. Also specifies that such technology cannot be used in broadcasts except for pay-per-view or pay-per-channel modes, but the latter is quickly becoming most of what people watch... Exceptions for professional and old equipment. Motto, hang onto that old VHS recorder. Only problem is the mechanisms don't last forever... www.eff.org has a lot of information on this. In particular, check out http://www.eff.org/IP/DMCA/20020503_dmca_consequences.html ------------------------------------------------------------------------ Total Information Awareness (July 2002) Vast government program to datamine every bit of information it can get its hands on... Use only cash. Don't browse the internet. Encrypt all your email now.