S/MIME also requires the use of RC2, which is not patented, although RSA may assert rights under trade secret law. This is still a bit controversial, and the issue of inclusion of RC2 in RIPEM has not been fully resolved yet. However, RSA has indicated a willingness to allow at least object code for RC2 to be released as part of the RIPEM distribution. The RC2 algorithm is only for compatibility with crippled "export" implemenations of S/MIME, and can be omitted if you're only ocmmunicating with non-crippled clients. (It should be noted that such a version would not be in compliance with the S/MIME implementation guide).
An RC2-compatible cipher ships with SSLeay these days. Not a problem. -- Sameer Parekh Voice: 510-986-8770 C2Net FAX: 510-986-8777 The Internet Privacy Provider http://www.c2.net/ sameer@c2.net