Re: On my HAVAL implementation

[paulo.barreto@xxxxxxxxxxxxxxx (Paulo Barreto)]

At 05:58 PM 98/04/03 -0800, Jon Callas <jon@xxxxxxx> wrote:

>At 03:41 PM 3/30/98 -0300, Paulo Barreto wrote:
>
>   1. Though my implementation is indeed public domain, the very algorithm is
>   *not*, as Dr. Yuliang Zheng clearly states in his HAVAL page.  However,
>   he's very liberal in conceding "licenses" (in fact, absolutely no fee is
>   due; Dr. Zheng only wants to keep track of where HAVAL is being used).
>   
>I'm a little concerned about this. It is my understanding of copyright law
>that one can copyright an *implementation* but not an algorithm. I wrote
>Dr. Zheng, and he gave me permission to put it in OpenPGP. However, I am
>still concerned about putting in an algorithm that someone claims
>"copyright" on. Furthermore, we need an OID for it.

I agree with you, but I'm not a lawyer, so I'm not sure about what can be
copyrighted and what can't; this could even be country-dependent.  But
since Dr. Zheng gave permission to use HAVAL in OpenPGP, I don't think this
is a problem anymore.

>Does anyone have an opinion? Should I strike HAVAL? Should I leave it there
>even if it's just a placeholder for later? It's certainly nice to have
>extra hash algorithms, but it is by no means something we should delay
>over. It can always go in 1.1.

Remember that there aren't that many 256-bit fast hashing functions around
(Tiger is only 192-bit, and the only other such a function I know of is J.
Daemen's StepRightUp, which is not widely known), so dropping HAVAL would
be a great loss.

Paulo Barreto.