How to legally circumvent the PGP 2.6 "legal kludge"!

How to legally circumvent the PGP 2.6 Legal Kludge.

According to the pgpdoc2.txt that comes with PGP 2.6:

>PGP version 2.6 can read anything produced by versions 2.3, 2.3a, 2.4,
>or 2.5.  However, because of a negotiated agreement between MIT and
>RSA Data Security, PGP 2.6 will change its behavior slightly on 1
>September 1994, triggered by a built-in software timer.  On that date,
>version 2.6 will start producing a new and slightly different data
>format for messages, signatures and keys.  PGP 2.6 will still be able
>to read and process messages, signatures, and keys produced under the
>old format, but it will generate the new format.  This incompatible
>change is intended to discourage people from continuing to use the
>older (2.3a and earlier) versions of PGP, which Public Key Partners
>contends infringes its RSA patent (see the section on Legal Issues).

This is the "legal kludge". However there is an undocumented PGP
parameter in PGP 2.6 which appears to be intended to allow the PGP
user to disable this "feature". This parameter may only be specified
on the command line using the "+" syntax. It is thought that it was
intended that one could disable this feature using a command like the
following:

pgp +legal_kludge=off -e file

However this does not work. In the source file config.c we find:

		  case LEGAL_KLUDGE:
			legal_kludge = value;
			break;

Since legal_kludge is a Boolean variable, the specified value "=off"
is in the variable "flag". Value usually has the wrong number, since
it is not set for Boolean values. Thus due to what appears to be a
bug, we can not use the "legal_kludge" parameter to disable the
kludge.  Perhaps the bug is not really a bug at all, but a
feature. After all it does limit the interpretability of pgp 2.6 with
earlier versions.

We can not fix this bug without violating MIT's licensing
requirements.

>2.  Software included in this compilation includes a feature that
>causes the format of messages generated by it to change on September
>1, 1994. Modification to this software to disable this feature is not
>authorized and will make this license, and the license in the
>underlying software, null and void.

If we were hell-bent to frustrate RSA and MIT, we would simply use
pgp26ui and not tell them about it rather than hack their sacred
kludge.

It would seem to be an impasse. Or is it? Note that value is declared
statically:

>static int value;


Every time a numeric parameter is parsed the variable value is used to
hold the number. So all we have to do is specify a numeric parameter
of zero before we specifying "legal_kludge"!  We can then set that
parameter back to the desired value if zero is not desired. That is
the following works!

>pgp +cert_depth=0 +legal_kludge=off +cert_depth=4 -e file

The above assumes that we wish to use 4 as the value of cert_depth.
We set cert_depth to zero only to get the value of "value" to 0.  The
the legal_kludge parameter will set the value of "legal_kludge" to be
=value=0, then we set cert_depth to the real desired value.

This trick is legal, because we have not modified pgp 2.6 in any way.
We are simply exploiting a bug or feature in the way PGP 2.6 is
written.

This kludge may seem to be too kludgy! It is asking a lot to ask users
to type such a thing! But is this really a problem? Most users do not
invoke PGP directly. They usually invoke PGP thru a mail program or
some other shell program.  These shell programs can be easily modified
to do the right thing.  In the worst case, people could define a shell
alias to invoke pgp with the incantation!

This discovery will allow people who must use PGP 2.6 to communicate
with people with earlier versions of PGP!
------------------------------------------------------------------------------
Paul Elliott                                  Telephone: 1-713-781-4543
Paul.Elliott@hrnowl.lonestar.org              Address:   3987 South Gessner #224
                                              Houston Texas 77063

--

-----BEGIN PGP SIGNED MESSAGE-----




On Tue, 19 Jul 1994, Paul Elliott wrote:

>  How to legally circumvent the PGP 2.6 Legal Kludge.
> 
[deleted]

> If we were hell-bent to frustrate RSA and MIT, we would simply use
> pgp26ui and not tell them about it rather than hack their sacred
> kludge.

[deleted]

> This discovery will allow people who must use PGP 2.6 to communicate
> with people with earlier versions of PGP!
> ---------------------------------------------------
> Paul Elliott                                  
> Paul.Elliott@hrnowl.lonestar.org            

I think I'll stay hell bent on frustrating MIT.
PZ has never spoken out against pgp26ui, I'll take that silence as 
implied consent while covering his ass legally. besides, 2.6ui lets you put
nifty ascii armour version names 

- --
Finger yusuf921@raven.csrv.uidaho.edu for PGP public key 2.6ui
GJ/GP -d+ h+ g? Au0 a- w+++ v+(?)(*) C++++ U++1/2 N++++ M-- -po+ Y+++
          t+ 5-- j++ r b+++ D+ b--- e+(*) u** h* r+++ y?  
- --

-----BEGIN PGP SIGNATURE-----
Version: 2.6MITSUX

iQCxAwUBLit4OMXmMf9qeaBdAQFpzwTdF1k0Osa812zyCZzn/sXCgvaarnFqFC3q
pGioFuvsXe9xOx9Om82jni803HQki07n/iHIBfV0ekkQKtZkmfCem2gIh9Vu+4lY
XUwUlFCDLfvkT+RH4J8AZCeLyxTRstHlX6w+ezm6WL+G38H3VVK+aAQAGDhDWwhb
yXv57lt1KFGlkvEGJs+FNSojhYQOn7NizYjAR5w/CdZZ9bHq
=Zhuk
-----END PGP SIGNATURE-----

Date: Tue, 19 Jul 94 5:48:41 +1800
    From: Paul Elliott <paul.elliott@hrnowl.lonestar.org>
    
     How to legally circumvent the PGP 2.6 Legal Kludge.

[ Analysis of and clever workaround for legal_kludge deleted ]
    
    This kludge may seem to be too kludgy! It is asking a lot to ask users
    to type such a thing! But is this really a problem? Most users do not
    invoke PGP directly. They usually invoke PGP thru a mail program or
    some other shell program.  These shell programs can be easily modified
    to do the right thing.  In the worst case, people could define a shell
    alias to invoke pgp with the incantation!
    
    This discovery will allow people who must use PGP 2.6 to communicate
    with people with earlier versions of PGP!

All of this is true.  As someone who decided to start using 2.6, and
who typically invokes it indirectly, I will start using it.  However,
Bizdos and buddies have still succeeded to some extent.  Some people
will use 2.6 without any attempt to bypass legal_kludge.  Also
Detweiler . . . I mean, Sue . . . may already be sending 800 zillion
copies of your message to rsa.com.

			Rick