Re: [Announce]: axspawn PAM with MD2, MD5, SHA1, RIPEMD160 and ARC4.

From: M Taylor (wmyocj.izxri@bonn.org)
Date: Sun Mar 18 2001 - 16:04:52 EET

  • Next message: Volker Schroer: "hfmodem"

    On Mon, 12 Mar 2001, Joerg Reuter wrote:

    > On Fri, Mar 09, 2001 at 07:42:16PM +0100, Luis Yanes wrote:
    >
    > > I emailed him some days ago telling about this, but probably still
    > > didn't readed my email.
    >
    > Thanks. I've been on a business trip last week. I'll take a look
    > at it -- there is one problem I see so far, and that is the
    > patent issue with some of these protocols. I know for sure we cannot
    > use MD2 (I've asked RSA Inc.) and need to check on the other prototocols.

    Regardless of the legal status (MD2 is a trademark of RSA Security I
    believe is the only restriction. It is not a trade secret, and I don't
    know of any patents for it.) MD2 is not recommended for new deployment
    since 1996 by RSA Labs. (ftp://ftp.rsasecurity.com/pub/pdfs/bulletn4.pdf)

    MD5 is freely available to the best of my knowledge. RFC 1321 Newly
    developed systems are not recommended to use it.

    SHA1 is freely available from
    <http://csrc.nist.gov/encryption/tkhash.html>. There are not
    trademark/patent/trade secret restrictions on using SHA-1.

    RIPEMD160 <http://www.esat.kuleuven.ac.be/~bosselae/ripemd160.html> is not
    patented.

    ARC4 (alleged RC4) is a hornet's nest. Considered to be derived an escaped
    copy of RC4 which was originally protected by US trade secrets laws. It is
    also a stream cipher, not a hashing algorithm.

    Of course, I suspect any of the above may be "offensive" to various
    national's amateur radio laws where ciphers, secret codes, or anything that
    obscures the meaning, is to be banned.

    What is needed is a challenge-response system, quite possibly using
    public-key based digital signatures. Where a random text is given, and
    the reponse is to return that random text signed. These method does not
    obscure anything, and any other amateur or government athority can
    clearly see what is happening. Either DSS (DSA) or RSA could be used.
    RSA is no longer patented in the USA.

    -
    To unsubscribe from this list: send the line "unsubscribe linux-hams" in
    the body of a message to ocr.lydra@d4-66.koba.pl



    This archive was generated by hypermail 2b30 : Sun Mar 18 2001 - 16:39:18 EET