ViaCrypt PGP and source code

I am sure that businesses will buy ViaCrypt PGP, even for $100.
PGP has proven itself to be a useful and safe encryption
package, and also can do digital signature, a feature not seen
in similarly priced PC security packages.

I think to not release the source code with ViaCrypt PGP is
a serious mistake.  First, I cannot see how releasing the 
RSA source can be harmful to ViaCrypt.  People can freely
examine PD PGP, I can't see how any trade secrets are going to
be revealed by showing the RSA source.  Perhaps it is slightly
faster, but information theoretic limits show that RSA quickly
becomes lengthy to encrypt, and I doubt PKP nor ViaCrypt have
made any significant progress towards making it faster compared
with PD PGP.

I had to laugh when people suggested the "Clipper-Like" review.
Why is it good for ViaCrypt, but not good for the government?

Let's face it...if ViaCrypt is serious about security, they will
release all source code for examination, and will digitally
sign all programs and have those signatures tracable to a
key on a ViaCrypt owned dial-up BBS.

I understand that there is a contractual problem with releasing
the RSA source.  Perhaps the contract should be re-negotiated.
I will bet ViaCrypt PGP will rapidly become a best-seller if
implemented properly.  There is plenty of money to be made if
everything is kept on the cryptographic "up and up."

-Thomas

>> I understand that there is a contractual problem with releasing
>> the RSA source.  Perhaps the contract should be re-negotiated.

You don't seem to understand that RSA has a monopoly.  You think they
are going to bend over backwards for ViaCrypt PGP when they are
pulling in millions in royalties from companies like Lotus?

>> I will bet ViaCrypt PGP will rapidly become a best-seller if
>> implemented properly.  There is plenty of money to be made if
>> everything is kept on the cryptographic "up and up."

"Nobody ever went broke underestimating the intelligence of the
American public."  Consider how unaware most people are today.
They're not going to care if they can audit the code; most people
don't have the skills anyway.  If AT&T or the government says
something is secure, they will be believed by most people.  Certain
large organizations (like banks) may have the clout (financial clout,
since that's what counts) to do their own code audit.  But Cypherpunks
just aren't big enough fish.  There's plenty of money to be made if
you aren't 'on the cryptographic "up and up"'.

If you don't want to buy ViaCrypt PGP because you can't get sources,
RSA isn't going to cry over those lost profits.  Their monopoly
insures that they can get their money from more compliant customers.

		Cynically yours,
		Marc