At 05:58 PM 98/04/03 -0800, Jon Callas <jon(_at_)pgp(_dot_)com> wrote:
At 03:41 PM 3/30/98 -0300, Paulo Barreto wrote:
1. Though my implementation is indeed public domain, the very algorithm is
*not*, as Dr. Yuliang Zheng clearly states in his HAVAL page. However,
he's very liberal in conceding "licenses" (in fact, absolutely no fee is
due; Dr. Zheng only wants to keep track of where HAVAL is being used).
I'm a little concerned about this. It is my understanding of copyright law
that one can copyright an *implementation* but not an algorithm. I wrote
Dr. Zheng, and he gave me permission to put it in OpenPGP. However, I am
still concerned about putting in an algorithm that someone claims
"copyright" on. Furthermore, we need an OID for it.
I agree with you, but I'm not a lawyer, so I'm not sure about what can be
copyrighted and what can't; this could even be country-dependent. But
since Dr. Zheng gave permission to use HAVAL in OpenPGP, I don't think this
is a problem anymore.
Does anyone have an opinion? Should I strike HAVAL? Should I leave it there
even if it's just a placeholder for later? It's certainly nice to have
extra hash algorithms, but it is by no means something we should delay
over. It can always go in 1.1.
Remember that there aren't that many 256-bit fast hashing functions around
(Tiger is only 192-bit, and the only other such a function I know of is J.
Daemen's StepRightUp, which is not widely known), so dropping HAVAL would
be a great loss.
Paulo Barreto.