What I wonder is whether someone could either:
1. buy a license from RSA to use PGP
The patent is held by Public Key Partners, not RSADSI. My
understanding is that you can purchase it (buy a right to use) and that
will give you the right to put it in any products you produce. From
what I understand (and this could be wrong, it's not easy to get
information on RSA) this implies that if just one organization
purchased RSA they could put it in the public domain. Again, I've only
heard this from one source, and have found it quite difficult to get a
straight story out of anyone on this.
or
2. use the RSAREF package to make a PGP-look-alike
This would work, however it would subject PGP to the rather strict
commercial restrictions placed on RSAREF: You can't profit from either
selling or supporting RSAREF or products that use it. You're not
allowed to optimize the code (but boy could it use it). And of course
you can't export it from the US or Canada (as per DOC/NSA
restrictions).
The restrictions on RSA are so involved they can give one the feeling
a conspiracy is afoot to stifle the use of encryption.
Now I should be quiet before I'm told to shut up for Reasons of
National Security. :) If anyone can provide a clearer and perhaps
more accurate picture of the restrictions on RSA please do so.
brad