Breakthrough

[David Farber <farber () central cis upenn edu>]

FYI -




More info: Kurt Stammberger, RSA Data Security, Inc. 415/595-8782
To download RSAREF and RIPEM, send  any message to rsaref () rsa com


RSA DATA SECURITY ANNOUNCES DIGITAL SIGNATURE SOFTWARE THAT IS FREE
AND LEGAL WORLDWIDE


Information superhighway gets free tool to authenticate information;
an answer to Vice-president Gore's concerns over Internet break-ins


---------------------------------------------------------


Redwood City, Calif. (March 21, 1994) - RSA Data Security, Inc.
announced today a first: digital signature software that is both free
and legal worldwide.


RSA applied for and received a "commodities jurisdiction," or CJ for a
software package called RIPEM, which was built with RSA Data
Security's RSAREF toolkit, a freeware package. A CJ, which is a ruling
that the software falls under the Commerce Department's jurisdiction
as opposed to the State Department, allows RIPEM to be freely and
legally exported.  Further, RSA has relaxed the use restrictions in
its free crypto toolkit. RSAREF, and any application built with it,
may now be used in commercial settings as long as it is not sold or
used to provide a direct for-profit service.


Digital signatures are produced using the RSA cryptosystem, which is a
public-key cryptosystem.  Each user has two keys - one public and one
private.  The public key can be disclosed without compromising the
private key.  The RSA cryptosystem was invented and patented in the
late 1970's by Drs. Rivest, Shamir, and Adleman at the Massachusetts
Institute of Technology.


Electronic documents can be "signed" with an unforgeable "signature"
by using a document/private-key combination to produce a signature unique
to the author/document.  Anyone, by using only RIPEM and the public
key of the author, can verify the authenticity of the document.


Applications of digital signatures are endless.  One reason that the
paperless office has never materialized is that paper must still be
printed so that handwritten signatures can be applied.  RSAREF and
RIPEM solve that problem.  Expense reports, any electronic forms,
administrative documents, even tax returns can be electronically
signed to speed electronic document flow and eliminate fraud.
Information on the Internet can be signed and verified to prevent
spoofing.  Recently, unauthenticated messages at Dartmouth College
caused an important test to be cancelled; messages impersonating
faculty were sent out.


"Data mailed, posted, or put on servers on the Internet is inherently
untrustable today," said Jim Bidzos, president of RSA. "Tampering with
electronic documents takes no special skills, and leaves no trace.
With the availability of a free, legal, and exportable tool such as
RIPEM, there's no need for such a situation to continue. It can be
used by individuals, corporations, and government agencies at no
cost."


In a February 4th announcement, Vice-president Gore stated that the
recent Internet break-ins could have been prevented with digital
signatures. "Here they are," said Bidzos.  Recently, cryptography has
caused clashes between government and industry, over privacy issues,
law enforcement concerns, and export issues.  "The US government has
approved this software for export," said Bidzos. "Clearly, it's no
threat to them. And it's free."


Digital signatures can also be used to detect any virus before a
program is executed, since any change whatsoever is detected.


The RIPEM application was developed using the RSAREF toolkit by Mark
Riordan of Michigan State University. A Macintosh version, developed
by Ray Lau of MIT, the author of the popular "Stufit" program, is also
available.  Versions for DOS, Unix, and all popular platforms are
supported. "PEM" stands for Privacy Enhanced Mail, a published
Internet standard for secure electronic mail.  Other innovative
applications can also be built with RSAREF and distributed at no cost.


RSA digital signatures are a standard feature of Lotus Notes, the
Apple System 7 Pro Operating System, Novell NetWare, Microsoft Windows
at Work, Windows NT, IBM System Security Products, DelRina PerformPro,
WordPerfect InForms, SHANA InFormed, BLOC F3 Forms, Fischer
International Workflow, and numerous other products. Over 3 million
commercial products in the market today already use RSA signatures
under license from RSA Data. Other RSA licensees include General
Magic, Hewlett-Packard, Oracle, Unisys, DIgital Equipment Corp,
Motorola, and numerous others.


RSA Data Security, Inc. designs, develops, markets, and supports
cryptographic solutions toolkits and products.  The company was
founded by the inventors of the RSA cryptosystem in 1982 and is
headquartered in Redwood City, California.