Installing PGP for RPM's Use

Know Your Laws!

Various countries have differing stances on the use of "strong encryption" products such as PGP. In some countries, possession of encryption software is strictly forbidden. Other countries attempt to control the flow of encryption technology into (or out of) their country. It is vital you know your country's laws, lest you find yourself in prison, or possibly in front of a firing squad!

Patent/Licensing Issues Surrounding PGP

Over and above PGP's legal status, there are other aspects to PGP that people living in the U.S. and Canada should keep in mind:

• PGP is free — for non-commercial use only. If you are going to use PGP for business purposes, you should look into getting a commercial copy. PGP is marketed in the United States by:

  Pretty Good Privacy, Inc.

                     2121 S. El Camino Real
                     Suite 902
                    San Mateo, CA 94403
                    (415) 572-0430
                    (415) 572-1932
                     http://www.pgp.com/
                  

• Part of the software that comprises PGP is protected by several United States patents. Versions of PGP approved for use in the U.S. contain a licensed version of this software, known as RSAREF. RSAREF includes a patent license that allows the use of the software in noncommercial settings only. Commercial use of the technology contained in RSAREF requires a separate license. This is one reason why there are restrictions on the commercial use of PGP in the United States and Canada.

  While people outside the U.S. and Canada can use RSAREF-based PGP, they will probably choose the so-called "international" version. This version replaces RSAREF with software known as MPILIB. MPILIB is, in general, faster than RSAREF, but it cannot legally be used in the United States or Canada.

To summarize, if you are using PGP for commercial purposes in the U.S. or Canada, you'll need to purchase it. Otherwise, people living in the U.S. or Canada should use a version of PGP incorporating RSAREF. People in other countries can use any version of PGP they desire, though they'll probably choose the MPILIB-based "international" version [1] .

Getting RSAREF-based PGP

The official source for the latest version of PGP based on RSAREF is the Massachusetts Institute of Technology. Due to the restrictions on the export of encryption technology, the process is somewhat convoluted. The easiest way to obtain PGP from the official MIT archive is to use the World Wide Web. Point your web browser at:

http://web.mit.edu/network/pgp.html

Simply follow the steps, and you'll have the necessary software on your system in no time.

There is a more cumbersome method that doesn't use the Web. It involves first using anonymous ftp to obtain several files of instructions and license agreements. You will then be directed to use telnet to obtain the name of a temporary ftp directory containing the PGP software. Finally, you can use anonymous ftp to retrieve the software. To start this process, ftp to:

ftp://net-dist.mit.edu

Then change directory to:

/pub/PGP

Obtain a copy of the file README and follow the instructions in it exactly.

If all this seems like too much trouble, there is another alternative. You can find copies of PGP on just about any BBS, FTP, or Web site advertising freely available software. Be aware, however, that "Floyd's Storm Door and BBS Company" may not be as trustworthy a place as MIT to obtain encryption software. It's really a question of how paranoid you are.

Outside the United States and Canada

For people living in other countries, it is much easier to find PGP (depending on the legality of encryption software, of course). Try any of the places you'd normally look for free software. Keep in mind, however, that you shouldn't download PGP from any sites in the U.S. Doing so is considered an "export" of munitions, and can get the people responsible for the site in deep trouble. Wherever you eventually get PGP from, since the patents that complicate matters for the U.S. do not apply abroad, you'll probably end up with the "international" versions of PGP.