Subject: ssh package

From: Michael Meskes <[email-masked]>
Date: Tue, 11 Jun 1996 14:19:37 +0200 (MET DST)

I really like the ssh package Dominik put up on his site. But I don't like
the idea of separating it from the distribution. As far as I understand teh
copyright issue it's the same problem as with pgp. Inside the US you have to
use that patented library while outside you can use other implementations.

Isn't it possible to create two versions of ssh, ssh-i and ssh-us, as we do
with pgp? I take it distributing the international version via the US is not
illegal is it?

Could someone please explain me if this is possible?

I assume Dominik is willing to create two version. Are you, Dominik?

Michael
-- 
Michael Meskes                   |    _____ ________ __  ____
[email-masked] |   / ___// ____/ // / / __ \___  __________
[email-masked]                  |   \__ \/ /_  / // /_/ /_/ / _ \/ ___/ ___/
[email-masked]                |  ___/ / __/ /__  __/\__, /  __/ /  (__  )
Use Debian Linux!		 | /____/_/      /_/  /____/\___/_/  /____/

---

From: Dominik Kubla <[email-masked]>
Date: Tue, 11 Jun 1996 21:16:12 +0200

Hi Michael,

Sorry for your Rhein Fire now definitely being out of the race for
WorldBowl '96!

But now back to Debian issues:

> I really like the ssh package Dominik put up on his site. But I
> don't like the idea of separating it from the distribution. As far
> as I understand teh copyright issue it's the same problem as with
> pgp. Inside the US you have to use that patented library while
> outside you can use other implementations.

Wrong: ITAR regulations do not permit any sensible military technology
(incl. cryptography) being moved out of the U.S. That includes DES and
therefore libc as well!  As it stands right now, anybody mirroring any
Linux distribution from the U.S (and anybody offering it!) is
violating U.S. laws.

IMHO we will have to split libcrypt from the rest of libc!  I
discussed that issue with H.J Lu about two years ago and he was not
willing to take any actions: "Don't wake sleeping dogs..."  Not very
sensible, but that is an attitude that many key-developers in the
Linux community share.

> Isn't it possible to create two versions of ssh, ssh-i and ssh-us,
> as we do with pgp? I take it distributing the international version
> via the US is not illegal is it?

It is (see above). 

> I assume Dominik is willing to create two version. Are you, Dominik?

No, i will not.  As it stands right now i am already contributing more
of my time to the Debian Project than i should (and originally
intended to).  I regard the ssh package as CONTRIBUTED SOFTWARE
WITHOUT MAINTENANCE which i only packaged for Debian because i was to
build it anyway.  I will make that clear in the next, and most likely
final, release.

CU,
  Dominik
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Visit the FAN SITE of the WORLD LEAGUE OF AMERICAN FOOTBALL:
<A HREF="http://www.uni-mainz.de/~kubla/WLAF/Welcome.html>HTTP</A> or
<A HREF="file:/afs/zdv.uni-mainz.de/homes/UFO/kubla/public_html/WLAF/Welcome.html">AFS file</A> access.

---

From: "Brian C. White" <[email-masked]>
Date: Tue, 11 Jun 1996 18:00:21 -0400

> sensible, but that is an attitude that many key-developers in the

I'm not sure what the scoop is with SSH, but...

"crypt" is not a form of encryption!  It is a one-way hash function,
just like MD5, CRC, and Checksum.  Granted, the later two can be
reversed with some difficulty.

Since there is no way to decode something encoded with "crypt", it
is not considered a threat by the government of the United States.

                                        Brian
                               ( [email-masked] )

-------------------------------------------------------------------------------
    In theory, theory and practice are the same.  In practice, they're not.

---

From: [email-masked]
Date: 11 Jun 1996 19:37:10 -0400

>> "crypt" is not a form of encryption!  It is a one-way hash function,

However, the *source code* to crypt includes a complete, slow
implementation of DES (with one modifiable internal permutation.)
Welcome to the looking glass...

---

From: Michael Meskes <[email-masked]>
Date: Wed, 12 Jun 1996 08:43:02 +0200 (MET DST)

> Sorry for your Rhein Fire now definitely being out of the race for

Never mind, was a great game on Sunday anyway.

> Linux distribution from the U.S (and anybody offering it!) is

But what's the situation with PGP? We do have an international and an US
version of PGP on master.

> > via the US is not illegal is it?

But then we're illegal anyway because of pgp.

> build it anyway.  I will make that clear in the next, and most likely

So it's orphaned. Could someone explain how the two pgp versions are
handeld? I don't think it'll be too much work to make two packages. In the
worst case both are orphaned.

Ian, you're maintaining pgp, could you please tell us whether ssh is
different?

Thanks
Michael