At 10:45 AM 1/25/00 , Eric Murray wrote:
>Real-To: Eric Murray <[EMAIL PROTECTED]>
>
>
>Does anyone know the legal status of RC4 in the US?
>
>I know that a cipher purporting to be RC4 was published on
>Cypherpunks by Anonymous, and that various crypto packages
>have RC4 or "EC4". My question is, has RSA taken anyone to
>court in the US for using RC4 without buying a license from RSA?
I haven't heard of such a case.
I see four possible approaches by which RSA could hold an interest in the
IP around RC4 - patent, trade secret, copyright, and trademark. With
respect to RC4, I believe the following -
1. No known patent covers RC4; so there is apparently no patent problem.
2. RSA used to say that the RC4 algorithm was a trade secret - but
it's been published in a book (see Applied Crypto) and so widely publicized
by now that not even the DVD people would say that it's still a trade
secret. So I think there's no trade secret problem.
3. If you don't have an author who's willing to take credit for
writing code, it's possible that the copyright in the code you're seeing
hasn't been licensed to you, so there's a potential copyright problem.
Safest course of action would be to reimplement RC4 from the published
descriptions of its workings, e.g., Applied Crypto.
4. RSA likely has a valid trademark in the term "RC4", so it's safest
to be careful about using the term so that you're not creating confusion in
the minds of consumers about whether or not you're providing them with
something created by RSA or yourself or some third party. Some people and
organizations have used the term ARC-four to describe an algorithm that
interoperates with RSA's RC4; I don't think it matters much what you call
it, so long as you're not creating confusion about who wrote the code and
the algorithm, or otherwise clobbering someone else's trademark.
--
Greg Broiles
[EMAIL PROTECTED]
PGP: 0x26E4488C
