CJR for perl-RSA t-shirt

Here is a draft of the CJR I intend to file, for the perl-RSA t-shirt.
Please check it over for technical inaccuracies or other problems. It
should sound quite familiar, as I have shamelessly ripped off the CJR
that Phil Karn filed for the Applied Cryptography book.

Let me know what you think!

Raph

=======================================================================
ATTN: Maj Gary Oncale - 15 Day CJ Request
U.S. Department of State
Office of Defense Trade Controls
PM/DTC SA-6 Room 200
1701 N. Fort Myer Drive
Arlington, VA  22209-3113
Fax +1 703 875 5845

ATTN: 15 Day CJ Request Coordinator
National Security Agency
P.O. Box 246
Annapolis Junction, MD  20701


Subject:  Mass Market Software with Encryption - 15 Day Expedited Review
          Requested

Subject:  Commodity Jurisdiction Request for
          perl-RSA t-shirt, an encryption program

INTRODUCTION

This is a Commodity Jurisdiction Request for mass market software
with encryption capabilities.  
 
The name of the software product is "perl-RSA t-shirt", by
Adam Back. It is published in the form of a t-shirt by Joel Furr, 916
W. Trinity Ave, #10, Durham NC 27701.

I have no DTC registration code.

I have reviewed and determined that this t-shirt, the subject of this CJ
request, meets paragraph 1 of the "Criteria for Determining the
Eligibility of A Mass Market Software Product for Expedited Handling."

I base this determination on the following facts:

a) this t-shirt is readily available from Joel Furr, and has been
shipped in quantity of several hundred copies, thus qualifying it as
mass market software;

b) sufficient documentation is included to allow installation and use
by any end user capable of typing in the software, or scanning the bar
code, and running it. Additional documentation is available on the
Internet World Wide Web at http://dcs.ex.ac.uk/~aba/rsa/ . To my
knowledge the author and publisher provide no "product support" as
that term is generally understood; and

c) the t-shirt contains encryption software source code listings that
provide confidentiality.

A duplicate copy of this CJR has been sent to the 15 Day CJ Request
Coordinator.

DESCRIPTION

The t-shirt contains an implementation of the RSA asymmetric
cryptographic algorithms. Furthermore, instructions, in the form of a
terse usage string, are given for using the implementation to provide
confidentiality. The source code of the implementation is featured
both as four lines of text and also as a bar code, making the t-shirt
machine readable as well as machine washable. The algorithm is
implemented in the Perl scripting language, and will run on any
standard Unix configuration that includes both an implementation of
the Perl language and the common "dc" (desk calculator) program.

Two copies of the shirt are included with the filing of this CJ
request.

ORIGIN OF COMMODITY

This t-shirt originates in the United States. While the primary author
is a citizen of the United Kingdom, living in England, other
contributors to the work are citizens of the US living in the US. The
publisher is a United States citizen living in the United States. The
t-shirts are manufactured and printed in the United States.

The cryptographic algorithm implemented in this t-shirt comes from
various sources, at various times, and was produced with both private
and public sources of funding.

The source code implementation contained in the t-shirt also comes
from a variety of countries, including Australia, Canada, the United
States and the United Kingdom.

The algorithm is thought to be designed for private and commercial
civilian use.

The t-shirt is currently publicly available from Joel Furr, at a list
price of $12.36, including shipping and handling. More ordering
information is available on the Internet World Wide Web at
http://www.danger.com/ad-perl.html .

CURRENT USE

The t-shirt is intended as an implementation of the RSA cipher for
those who wish to incorporate encryption into their communications.
The small size of the implementation makes it particularly useful in
contexts in which existing cryptographic infrastructure is not
available.

Examples of the commercial use of the cipher implemented include
integrity verification, authentication and confidentiality of
electronic mail, computer software, voice, video and other information
in digitized form. For example, the cipher is used either by itself
for email privacy, and also as a component in other protocols that
provide privacy and authentication, including PGP (Pretty Good
Privacy), S/MIME (Secure Multipurpose Internet Mail Extensions), MOSS
(MIME Object Security Services), PEM (Privacy Enhanced Mail), and SSL
(Secure Sockets Layer).

The uses of this cipher have not changed significantly over time,
although their popularity has grown substantially. Their present
military utility is unknown, except that it is believed that the
algorithm is not approved for the protection of US classified
information.

SPECIAL CHARACTERISTICS

There are no military standards or specifications that this t-shirt is
designed to meet. There are no special characteristics of the t-shirt,
including no radiation-hardening, no ballistic protection, no hard
points (the t-shirt is only available in soft 100% cotton), no TEMPEST
capability, no thermal and no infrared signature reduction capability
(in excess of that provided by a typical black cotton t-shirt), no
surveillance, and no intelligence gathering capability. The t-shirt
does not use image intensification tubes.

OTHER INFORMATION

I recommend that this t-shirt be determined to be in the jurisdiction
of the Commerce Department. I believe that it qualifies for the
general license GTDA for General Technical Data to All Destinations,
because it qualifies as "publicly available".

ATTACHMENTS

I have enclosed two copies of the t-shirt, included with the primary
filing of this CJ request.


                                        Sincerely,



                                        Raphael L. Levien

-----BEGIN PGP SIGNED MESSAGE-----

Hello Raph Levien <raph@CS.Berkeley.EDU>

You write:
> Here is a draft of the CJR I intend to file, for the perl-RSA t-shirt.
...

IANAL, and I know absolutely *nothing* about what a CJR should look like.

...
> ORIGIN OF COMMODITY
...
> The cryptographic algorithm implemented in this t-shirt comes from
> various sources, at various times, and was produced with both private
> and public sources of funding.

I don't think this is accurate: I guess this applies to the book
which contains several algorithms. As far as I know, the RSA alg.
comes from one source at one time.

...
> CURRENT USE
> 
> The t-shirt is intended as an implementation of the RSA cipher for
> those who wish to incorporate encryption into their communications.
> The small size of the implementation makes it particularly useful in
> contexts in which existing cryptographic infrastructure is not
> available.
...

Perhaps somebody should make IDEA shorts?

Then it would be interoperable with PGP...
(Would tooooo. You just have to remember what the header is.)


Hope that makes sense...

Jiri
- --
If you want an answer, please mail to <jirib@cs.monash.edu.au>.
On sweeney, I may delete without reading!
PGP 463A14D5 (but it's at home so it'll take a day or two)
PGP EF0607F9 (but it's at uni so don't rely on it too much)

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBMHxllCxV6mvvBgf5AQEN8wQApplb/R+FLZcUU4ro6c8d4DIcCYK0KIbT
5LGfhtq5tN9IJPZ/00Z/otHDBztD+PDEzC2KI2EI724FEOAtvHR6ZnopkWcST500
2Ly/OEJJ+oAO2IyOkbyJ3AQCax6RkCGLrFiSGSi4N5Z24ZZ3Ovp+LTzqxyEF/81y
6Vu1dRK1Zuk=
=3J6S
-----END PGP SIGNATURE-----

On Thu, 12 Oct 1995, Jiri Baum wrote:

> 
> Perhaps somebody should make IDEA shorts?
> 
> Then it would be interoperable with PGP...
> (Would tooooo. You just have to remember what the header is.)

You'd still need an MD5 necktie.

(and your matching stealth sunglasses? When does this go too far?
This ridiculous looking figure is begging for its own worlds chat avatar.
Violate ITAR and good fashion in vr. Which begs the question, would anyone
notice if First Cypherpunks Bank were operating in such a networked video 
game? Now *that* would be a non-bank financial institution. I can just 
see it in court: "your honor, the disclaimer clearly says it is all a game,
the state's agents have simply suspended all disbelief". Talk about stego.)

-----BEGIN PGP SIGNED MESSAGE-----

Hello s1018954@aix2.uottawa.ca
 
> On Thu, 12 Oct 1995, Jiri Baum wrote:
> 
> > 
> > Perhaps somebody should make IDEA shorts?
> > 
> > Then it would be interoperable with PGP...
> > (Would tooooo. You just have to remember what the header is.)
> 
> You'd still need an MD5 necktie.

Actually, you don't - you just don't get signatures without it.
However, authentication AFAIK was never a problem to export,
so there's no need to bother.

If you are reading a signed message, you simply strip off the
signature without checking it (or you leave it on and pass it
through a hypothetical exportable auth-only PGP).

For creating messages, you have to make do without signatures.

What you *would* need would be a coin, but I guess this is
generally available (you know, flip it a hundred times to
generate the session key).

> (and your matching stealth sunglasses? When does this go too far?
> This ridiculous looking figure is begging for its own worlds chat avatar.
> Violate ITAR and good fashion in vr. Which begs the question, would anyone
> notice if First Cypherpunks Bank were operating in such a networked video 
> game? Now *that* would be a non-bank financial institution. I can just 
> see it in court: "your honor, the disclaimer clearly says it is all a game,
> the state's agents have simply suspended all disbelief". Talk about stego.)

Hmm, just like Monopoly money, I guess.

Nobody's been busted yet for printing that, have they.


Jiri
- --
If you want an answer, please mail to <jirib@cs.monash.edu.au>.
On sweeney, I may delete without reading!
PGP 463A14D5 (but it's at home so it'll take a day or two)
PGP EF0607F9 (but it's at uni so don't rely on it too much)

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBMHyi5ixV6mvvBgf5AQGttgQA2LpV4T7QTZvZ6C0NajnFmsDvAEOZuqVR
N9rL9fiBh52KWTRYxqr/284onyJFkgyMUljDggSZvfNlhx3kV/J03Yne+sJAMoL1
NOVOoQtKAbbQ1ixD8fXMD1ybehmU1BaB2VVfwrY7vdn4gky6ZUlpU/4dQ3hArms3
Ni63Gaf7iwE=
=33pa
-----END PGP SIGNATURE-----

On Thu, 12 Oct 1995, Jiri Baum wrote:

> > You'd still need an MD5 necktie.
> 
> Actually, you don't - you just don't get signatures without it.
> However, authentication AFAIK was never a problem to export,
> so there's no need to bother.

True, but there's still a licencing requirment in the states (might be 
different up here). So an authentication necktie (as opposed to 
cryptographic shorts and shirts) would be on the principle that one should
not need a licence to write software. 

> Hmm, just like Monopoly money, I guess.
> 
> Nobody's been busted yet for printing that, have they.
They don't care, too easy to counterfeit. Inflation through photocopying
would make monopoly currency as worthless as the funny money it is now.

OTOH, if you threw in strong two-way anon digicash onto a networked version,
you'd basically have a gambling setup masquarading as a MUD. See how long 
that would last unscathed? It would be a nice way to introduce the masses
to the concepts though. Make the code available and you might see servers 
springing up faster than the present digicash casinos. And since any of 
the parties involved might be tempted to cheat ("upgrading" the server in 
the sysadmin's favor, ganging up ...) some authentication might be needed.
Which means even more education for Joe Gambler.

Since doing this for real money, even real digicash, is already illegal 
in many places, it would finally drive home the need for anon security
and crypto to the eager gambler (of which there are many more than eager
pgp users).

If you make it look loony enough, the authorities might find it beneath them
to do anything. Given any success you could launch some additional for-pay 
services based on the same platform.

It's only a game, right?

On Thu, 12 Oct 1995, Jiri Baum wrote:

> 
> If you are reading a signed message, you simply strip off the

Not a good choice of words - remember, you should never expose your 
private, er, key...

Simon
---
(defun modexpt (x y n)  "computes (x^y) mod n"
  (cond ((= y 0) 1)   ((= y 1) (mod x n))
	((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n))
	(t (mod (* x (modexpt x (1- y) n)) n))))