DSA2

[David Shaw]

On Wed, Sep 27, 2006 at 12:08:31AM +0200, Carlo Luciano Bianco wrote:
> Il /25 set 2006/, *John Clizbe* ha scritto:
> 
> > There were a couple messages last year on the [cryptography]
> > mailing list wrt ECC and patents:
> 
> Thank you very much for the links, they are very interesting!
> 
> > Actually the ECC code in OpenSSL was supplied by Sun and is
> > patented by Sun. Sun contributed the code in 2002, but it was not
> > made part of OpenSSL until 2005, as part of OpenSSL 0.9.8. On the
> > patented code, Sun says: 
> > 
> >    Q7: What about the patented technology in the contributed code?
> > 
> >    Sun acknowledges that it has some patented ECC technology in
> >    the contributed code.
> > 
> >    Sun grants to OpenSSL users the right to make use of the
> >    contributed patented technology in the context of OpenSSL.
> 
> Well... Does this mean that we can link GnuPG to OpenSSL library for
> ECC subroutines and stay safe from patent problems? If so, this can
> be a temporary solution (of course, if OpenSSL license is compatible
> with GnuPG one)...

No, the licenses are not compatible.  We had quite a problem (and are
still fixing the fallout) with even a small license exception to allow
linking the LDAP and CURL keyserver helpers to OpenSSL for ldaps and
https.

Plus there are the patent issues, which raise a very large headache
for Free software in general.

In any event, it doesn't matter even if the licenses were compatible:
OpenPGP does not have ECC in it.  GnuPG won't support ECC until the
OpenPGP standard specifies it.  I don't see that happening any time
soon, especially given the patent issues.

David