PKware doesn't sell PKzip for OVMS; does anyone have a license?

[Clark Powell]

We have just added a new member to our alpha cluster and were startled to find that the PKware company cannot even create a new license key for us to run PKzip on our new cluster member. Apparently, they've decided to not support OpenVMS in any way. At this point in time we are not looking for a new solution but would just like to enable PKzip on the new node for a while. Does anyone out there have a license key for PKzip for OpenVMS that they don't need? We just need to run on PKzip for a short while until we have time to implement one of the many, more sophisticated encryption solutions.
thanks
WCP

[Hoff]

This pkzip stuff?

http://www.xlsoft.com/en/products/pkzip/pz_openvms.html

Do you have formal permission to do this?

Simply because a company discontinues or retires a product doesn't mean it necessarily reverts into the public domain, and it also doesn't necessarily mean that anybody can provide you with their license key, and it doesn't mean that somebody can reverse engineer and remove the license check(s).

With explicit written permission from the product owner of record allowing someone to reverse engineer the product, it's certainly feasible to disable most any copy protection or licensing scheme around. This reverse engineering really isn't usually all that technically difficult -- but this sort of electronic lock-smithing entirely hinges on having explicit permission of the owner.

If the vendor provides a compiler listing of the module containing the license check (and preferably with the machine code), the lock-smithing is easier.

Or the vendor can clear somebody (else) to provide you with a license key, or can potentially release or clear the release of a license key widely as has happened with a few (retired) products around, or can authorize somebody to issue a license key on behalf of the vendor.

Either of the above approaches -- getting a license key somehow, or cracking the security -- are entirely dependent on what the product owner explicitly authorizes.

The other approach is to use another encryption scheme, with or without compression. To not use pkzip, but something else. Current OpenVMS has AES, and earlier versions had DES. And there are lower-grade schemes around, as has been discussed. And there's reportedly an AES patch around for the current INFO-ZIP software. Reportedly compatible with pkzip, too.

Tere's a related recent thread: http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1091080

Stephen Hoffman
HoffmanLabs

[Clark Powell]

Of course, we would make sure that what ever solution we find will be within the confines of a legal software agreement. At this point though, we know of no other licenses in the universe other than the one we have in our files. If we are able to find a license then we will ask the vendor if they will allow a transfer.

Your point about using an alternate method is well taken. PKZIP is very weak security and we will replace it as soon as we have time. But for the next month or so we must use PKzip.

thanks
Clark Powell

[Steven Schweda]

> [...] PKZIP is very weak security [...]

PKZIP's weak encryption is weak. I'm told
that PKZIP's strong encryption is not weak.

If you're using only the old, original, weak
encryption of PKZIP, then I'd expect the
Info-ZIP Zip and UnZip programs to be useful
replacements for PKZIP. If you're using the
newer strong encryption, then the Info-ZIP
programs are unlikely to be helpful.

I believe that patches have been created to
allow the Info-ZIP programs to do
PKZIP-compatible AES, but there are potential
patent problems which need clarification
before such code is adopted by Info-ZIP.

[Hoff]

The Info-Zip zip and unzip are expected to work out-of-the-box with the older and non-AES encryption used within pkzip. If you're using the older (and comparatively weak) encryption, you should be able to interoperate. Try it.

As for the pkzip product, if the vendor explicitly clears it, the existing pkzip for OpenVMS can likely be cracked open either for your use, or for general use. This access based on just the existing binaries, assuming these are available. And this is with or without vendor assistance, so long as there are written agreements in place around cracking the existing licensing open.

And if pkzip used LMF, opening up access is easier. With the right mail messages and such to the right folks, a "new" LMF PAK can be generated for the package.

In deference to the ITRC and to other such, I'd expect most folks here are not going to discuss specifics of how to defeat licensing. Beyond the generic "it's feasible", that is. Nor would I expect folks here to blindly provide license keys, either.

Stephen Hoffman
HoffmanLabs

[Doug Phillips]

I know this isn't the best forum for this discussion, and IANAL, but Hoff's statement:

>>
Simply because a company discontinues or retires a product doesn't mean it necessarily reverts into the public domain, and it also doesn't necessarily mean that anybody can provide you with their license key,
<<

hits one of my hot spots. It *really* needs to be explored further legally by someone willing and able to do so.

Not that a product should revert to public domain, but that anytime a company stops selling and supporting and licensing a product, then that company has terminated its side of the license agreement. Licenses, like all contracts, are agreements between two parties; each with obligations to the other.

The producer, by ceasing sales, support and further licensing of the product, has denied expection of future profits from that product, and all such protection as granted by the license, is vacated. Any stated expectations about how the product should function are also now unsupported.

Copyrights, patents, trade secrets and other protections still apply, but the "right to use" license for a dead product should now defer to the "right of first use" laws.

Meaning, you should now be able to treat the product just like any other. You can sell or give away a book you buy or receive, but you can't reproduce or copy it or use its workings as your own.

In fact, a quick search shows that the right of first use for software is not a new concept, and not just for dead products.

BTW, the wording on a license or contract cannot supercede the law. That's why most have a statement like: "If any provision of this ... is held invalid, the remainder of this ... shall continue in full force and effect."

So, just because a license says something, that doesn't mean it's legal.

Like I said, I am not a lawyer, but a little research will show you that there's another side to this subject that you won't hear from the licensors.

Now, back to your regularly scheduled programming.

[VMS Support]

I suggest that you challenge PKware again. Having spoken to them in the last few months (via UK) they *may* be willing to manually generate a VMS license PAK for you - but at a price. Expect >$2500 per user.

[Clark Powell]

Thanks, I don't know if the PKware folks in the US will make a license based on what they told me, they won't but in the UK maybe they still like to get money. thanks, all. I'm closing the thread now.

[Steven Schweda]

I'll admit that it's none of my business, but
I'd still like to know if you're using
features which are missing from the Info-ZIP
programs, or if you have some other reason
for insisting on PKZIP.