A copy of RSAREF source is in an archive called pgp262s.tar.gz which is available inside the US at some FTP sites - not for export. When I get some time I will probably see if it compiles against the published pgp5.0 sources. It should be no problem technically and will keep me legal for nonn-commercial use. http://www.beyond.com/ sell a wide range of license packs in the US for those using pgp for work. http://www.pgpinternational.com/ seems to be the NAI site selling commercial licences for the rest of the world. Thanks for your interest. dproc