IDEA licensing issues

[David Shaw]

On Mon, Jan 21, 2008 at 05:23:21PM -0600, Robert J. Hansen wrote:
> Alan Olsen wrote:
>> I have been trying to find what it takes to get a license for using
>> IDEA with gpg.
>
> The first question is why you need IDEA in the first place.  It's a usable 
> cipher, but it's hardly a paragon of modern design.  Better than brute 
> force attacks exist against at least 4.5 of its eight rounds, and more may 
> have been discovered since I last read the literature.

Indeed.  Pretty much the only reason to use IDEA in the OpenPGP
context in this day and age is because you want some level of
compatibility with PGP 2.x or are similarly being forced into it for
other (non-crypto) reasons.  I try hard to stay out of the
newer=better discussions, but I believe it is safe to say that AES is
"better" than IDEA for pretty much any crypto criteria you'd normally
use, and most of the non-crypto criteria as well.  Plus, you don't
need a license for it.

> Assuming you need IDEA, the last I heard the terms of the patent license 
> involved it being free for noncommercial use.

It looks like the Mediacrypt people are having some problems.
www.mediacrypt.com is down and idea (@) mediacrypt.com bounces.

DAvid