CJR for perl-RSA t-shirt
Here is a draft of the CJR I intend to file, for the perl-RSA t-shirt. Please check it over for technical inaccuracies or other problems. It should sound quite familiar, as I have shamelessly ripped off the CJR that Phil Karn filed for the Applied Cryptography book. Let me know what you think! Raph ======================================================================= ATTN: Maj Gary Oncale - 15 Day CJ Request U.S. Department of State Office of Defense Trade Controls PM/DTC SA-6 Room 200 1701 N. Fort Myer Drive Arlington, VA 22209-3113 Fax +1 703 875 5845 ATTN: 15 Day CJ Request Coordinator National Security Agency P.O. Box 246 Annapolis Junction, MD 20701 Subject: Mass Market Software with Encryption - 15 Day Expedited Review Requested Subject: Commodity Jurisdiction Request for perl-RSA t-shirt, an encryption program INTRODUCTION This is a Commodity Jurisdiction Request for mass market software with encryption capabilities. The name of the software product is "perl-RSA t-shirt", by Adam Back. It is published in the form of a t-shirt by Joel Furr, 916 W. Trinity Ave, #10, Durham NC 27701. I have no DTC registration code. I have reviewed and determined that this t-shirt, the subject of this CJ request, meets paragraph 1 of the "Criteria for Determining the Eligibility of A Mass Market Software Product for Expedited Handling." I base this determination on the following facts: a) this t-shirt is readily available from Joel Furr, and has been shipped in quantity of several hundred copies, thus qualifying it as mass market software; b) sufficient documentation is included to allow installation and use by any end user capable of typing in the software, or scanning the bar code, and running it. Additional documentation is available on the Internet World Wide Web at http://dcs.ex.ac.uk/~aba/rsa/ . To my knowledge the author and publisher provide no "product support" as that term is generally understood; and c) the t-shirt contains encryption software source code listings that provide confidentiality. A duplicate copy of this CJR has been sent to the 15 Day CJ Request Coordinator. DESCRIPTION The t-shirt contains an implementation of the RSA asymmetric cryptographic algorithms. Furthermore, instructions, in the form of a terse usage string, are given for using the implementation to provide confidentiality. The source code of the implementation is featured both as four lines of text and also as a bar code, making the t-shirt machine readable as well as machine washable. The algorithm is implemented in the Perl scripting language, and will run on any standard Unix configuration that includes both an implementation of the Perl language and the common "dc" (desk calculator) program. Two copies of the shirt are included with the filing of this CJ request. ORIGIN OF COMMODITY This t-shirt originates in the United States. While the primary author is a citizen of the United Kingdom, living in England, other contributors to the work are citizens of the US living in the US. The publisher is a United States citizen living in the United States. The t-shirts are manufactured and printed in the United States. The cryptographic algorithm implemented in this t-shirt comes from various sources, at various times, and was produced with both private and public sources of funding. The source code implementation contained in the t-shirt also comes from a variety of countries, including Australia, Canada, the United States and the United Kingdom. The algorithm is thought to be designed for private and commercial civilian use. The t-shirt is currently publicly available from Joel Furr, at a list price of $12.36, including shipping and handling. More ordering information is available on the Internet World Wide Web at http://www.danger.com/ad-perl.html . CURRENT USE The t-shirt is intended as an implementation of the RSA cipher for those who wish to incorporate encryption into their communications. The small size of the implementation makes it particularly useful in contexts in which existing cryptographic infrastructure is not available. Examples of the commercial use of the cipher implemented include integrity verification, authentication and confidentiality of electronic mail, computer software, voice, video and other information in digitized form. For example, the cipher is used either by itself for email privacy, and also as a component in other protocols that provide privacy and authentication, including PGP (Pretty Good Privacy), S/MIME (Secure Multipurpose Internet Mail Extensions), MOSS (MIME Object Security Services), PEM (Privacy Enhanced Mail), and SSL (Secure Sockets Layer). The uses of this cipher have not changed significantly over time, although their popularity has grown substantially. Their present military utility is unknown, except that it is believed that the algorithm is not approved for the protection of US classified information. SPECIAL CHARACTERISTICS There are no military standards or specifications that this t-shirt is designed to meet. There are no special characteristics of the t-shirt, including no radiation-hardening, no ballistic protection, no hard points (the t-shirt is only available in soft 100% cotton), no TEMPEST capability, no thermal and no infrared signature reduction capability (in excess of that provided by a typical black cotton t-shirt), no surveillance, and no intelligence gathering capability. The t-shirt does not use image intensification tubes. OTHER INFORMATION I recommend that this t-shirt be determined to be in the jurisdiction of the Commerce Department. I believe that it qualifies for the general license GTDA for General Technical Data to All Destinations, because it qualifies as "publicly available". ATTACHMENTS I have enclosed two copies of the t-shirt, included with the primary filing of this CJ request. Sincerely, Raphael L. Levien
-----BEGIN PGP SIGNED MESSAGE----- Hello Raph Levien <raph@CS.Berkeley.EDU> You write:
Here is a draft of the CJR I intend to file, for the perl-RSA t-shirt. ...
IANAL, and I know absolutely *nothing* about what a CJR should look like. ...
ORIGIN OF COMMODITY ... The cryptographic algorithm implemented in this t-shirt comes from various sources, at various times, and was produced with both private and public sources of funding.
I don't think this is accurate: I guess this applies to the book which contains several algorithms. As far as I know, the RSA alg. comes from one source at one time. ...
CURRENT USE
The t-shirt is intended as an implementation of the RSA cipher for those who wish to incorporate encryption into their communications. The small size of the implementation makes it particularly useful in contexts in which existing cryptographic infrastructure is not available. ...
Perhaps somebody should make IDEA shorts? Then it would be interoperable with PGP... (Would tooooo. You just have to remember what the header is.) Hope that makes sense... Jiri - -- If you want an answer, please mail to <jirib@cs.monash.edu.au>. On sweeney, I may delete without reading! PGP 463A14D5 (but it's at home so it'll take a day or two) PGP EF0607F9 (but it's at uni so don't rely on it too much) -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMHxllCxV6mvvBgf5AQEN8wQApplb/R+FLZcUU4ro6c8d4DIcCYK0KIbT 5LGfhtq5tN9IJPZ/00Z/otHDBztD+PDEzC2KI2EI724FEOAtvHR6ZnopkWcST500 2Ly/OEJJ+oAO2IyOkbyJ3AQCax6RkCGLrFiSGSi4N5Z24ZZ3Ovp+LTzqxyEF/81y 6Vu1dRK1Zuk= =3J6S -----END PGP SIGNATURE-----
On Thu, 12 Oct 1995, Jiri Baum wrote:
Perhaps somebody should make IDEA shorts?
Then it would be interoperable with PGP... (Would tooooo. You just have to remember what the header is.)
You'd still need an MD5 necktie. (and your matching stealth sunglasses? When does this go too far? This ridiculous looking figure is begging for its own worlds chat avatar. Violate ITAR and good fashion in vr. Which begs the question, would anyone notice if First Cypherpunks Bank were operating in such a networked video game? Now *that* would be a non-bank financial institution. I can just see it in court: "your honor, the disclaimer clearly says it is all a game, the state's agents have simply suspended all disbelief". Talk about stego.)
-----BEGIN PGP SIGNED MESSAGE----- Hello s1018954@aix2.uottawa.ca
On Thu, 12 Oct 1995, Jiri Baum wrote:
Perhaps somebody should make IDEA shorts?
Then it would be interoperable with PGP... (Would tooooo. You just have to remember what the header is.)
You'd still need an MD5 necktie.
Actually, you don't - you just don't get signatures without it. However, authentication AFAIK was never a problem to export, so there's no need to bother. If you are reading a signed message, you simply strip off the signature without checking it (or you leave it on and pass it through a hypothetical exportable auth-only PGP). For creating messages, you have to make do without signatures. What you *would* need would be a coin, but I guess this is generally available (you know, flip it a hundred times to generate the session key).
(and your matching stealth sunglasses? When does this go too far? This ridiculous looking figure is begging for its own worlds chat avatar. Violate ITAR and good fashion in vr. Which begs the question, would anyone notice if First Cypherpunks Bank were operating in such a networked video game? Now *that* would be a non-bank financial institution. I can just see it in court: "your honor, the disclaimer clearly says it is all a game, the state's agents have simply suspended all disbelief". Talk about stego.)
Hmm, just like Monopoly money, I guess. Nobody's been busted yet for printing that, have they. Jiri - -- If you want an answer, please mail to <jirib@cs.monash.edu.au>. On sweeney, I may delete without reading! PGP 463A14D5 (but it's at home so it'll take a day or two) PGP EF0607F9 (but it's at uni so don't rely on it too much) -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMHyi5ixV6mvvBgf5AQGttgQA2LpV4T7QTZvZ6C0NajnFmsDvAEOZuqVR N9rL9fiBh52KWTRYxqr/284onyJFkgyMUljDggSZvfNlhx3kV/J03Yne+sJAMoL1 NOVOoQtKAbbQ1ixD8fXMD1ybehmU1BaB2VVfwrY7vdn4gky6ZUlpU/4dQ3hArms3 Ni63Gaf7iwE= =33pa -----END PGP SIGNATURE-----
On Thu, 12 Oct 1995, Jiri Baum wrote:
If you are reading a signed message, you simply strip off the
Not a good choice of words - remember, you should never expose your private, er, key... Simon --- (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))
On Thu, 12 Oct 1995, Jiri Baum wrote:
You'd still need an MD5 necktie.
Actually, you don't - you just don't get signatures without it. However, authentication AFAIK was never a problem to export, so there's no need to bother.
True, but there's still a licencing requirment in the states (might be different up here). So an authentication necktie (as opposed to cryptographic shorts and shirts) would be on the principle that one should not need a licence to write software.
Hmm, just like Monopoly money, I guess.
Nobody's been busted yet for printing that, have they. They don't care, too easy to counterfeit. Inflation through photocopying would make monopoly currency as worthless as the funny money it is now.
OTOH, if you threw in strong two-way anon digicash onto a networked version, you'd basically have a gambling setup masquarading as a MUD. See how long that would last unscathed? It would be a nice way to introduce the masses to the concepts though. Make the code available and you might see servers springing up faster than the present digicash casinos. And since any of the parties involved might be tempted to cheat ("upgrading" the server in the sysadmin's favor, ganging up ...) some authentication might be needed. Which means even more education for Joe Gambler. Since doing this for real money, even real digicash, is already illegal in many places, it would finally drive home the need for anon security and crypto to the eager gambler (of which there are many more than eager pgp users). If you make it look loony enough, the authorities might find it beneath them to do anything. Given any success you could launch some additional for-pay services based on the same platform. It's only a game, right?
participants (4)
-
Jiri Baum -
Raph Levien -
s1018954＠aix2.uottawa.ca -
Simon Spero