🚀 go-pugleaf

In article <BURT.93Jan6093746@chirality.rsa.com>, burt@chirality (Burt Kaliski) writes:
>Sorry, U.S. persons only.

Could someone please post the copyright notices of the RIPEM and
RSAREF packages (or possibly just the code) here?

(disclaimer: before doing so, you might want to check whether it is
allowed by (including but not limited to) the U.S. government, the
authors of the copyright notices, the Iraqi government, the Chinese
government, any of the other governments of the countries in the
world, your mother, your pets if any, your computer vendor if any,
your insurance policy if any, your pension plan if any, your
highschool headmaster if any)

//Jyrki

In article <1993Jan6.224021.986@nntp.hut.fi>, jkp@cs (Jyrki Kuoppala) writes:
>Could someone please post the copyright notices of the RIPEM and
>RSAREF packages (or possibly just the code) here?

To partly answer my own question:

From: mrr@cl.msu.edu (Mark Riordan)
Newsgroups: sci.crypt
Subject: Announcing RIPEM 1.0
Summary: Release of RIPEM public key crypto program
Message-ID: <1h8jbuINNn52@msuinfo.cl.msu.edu>
Date: 23 Dec 92 02:36:46 GMT
Organization: Michigan State University
Lines: 244
NNTP-Posting-Host: scss3.cl.msu.edu
X-Newsreader: TIN [version 1.1 PL6]

Announcing the availability of RIPEM 1.0, a public key encryption
program oriented toward use with electronic mail.

[ deleted ... ]

LICENSING

RIPEM itself (i.e., the code I wrote) is in the public domain.
However, RIPEM is based on RSA Data Security's RSAREF cryptographic
toolkit.  RSAREF is not in the public domain, but its authors, RSA
Data Security, do license it free of charge for non-commercial use.
Because RIPEM uses RSAREF, use of RIPEM is subject to the RSAREF
license agreement.

The RSAREF program license seems pretty straightforward.  It
can be obtained via anonymous FTP from rpub.cl.msu.edu, and is
distributed along with the RIPEM source.  Also, I intend to post
the RSAREF license to sci.crypt.  You should read the license before
using RIPEM, because use of RIPEM is dependent upon your agreeing
to the RSAREF terms.

[ rest deleted ]

In article <BURT.93Jan6093746@chirality.rsa.com> burt@chirality.rsa.com (Burt Kaliski) writes:
>RSAREF is now available via anonymous FTP to 'rsa.com'. Along with
>RSAREF you can get RIPEM, Mark Riordan's RSAREF-based privacy-enhanced
>mail application, and an Emacs command interface to RIPEM. See the
>file 'README' in the FTP directory 'rsaref' for more information.
>
>Sorry, U.S. persons only.
>
>-- Burt Kaliski
>RSA Laboratories

Why not Canadians?
Considering that RSAREF has been distributed to Canadian citizens on
Canadian hosts the past, it seems strange that we are excluded
from distrubution via anonymous ftp from rsa.com

Mark
-- 
Mark Henderson
markh@wimsey.bc.ca
RIPEM key available by key server/finger/E-mail

In article <1993Jan6.224021.986@nntp.hut.fi> jkp@cs.HUT.FI (Jyrki Kuoppala) writes:
>In article <BURT.93Jan6093746@chirality.rsa.com>, burt@chirality (Burt Kaliski) writes:
>>Sorry, U.S. persons only.
>
>Could someone please post the copyright notices of the RIPEM and
>RSAREF packages (or possibly just the code) here?
>
>(disclaimer: before doing so, you might want to check whether it is
>allowed by (including but not limited to) the U.S. government, the
>authors of the copyright notices, the Iraqi government, the Chinese
>government, any of the other governments of the countries in the
>world, your mother, your pets if any, your computer vendor if any,
>your insurance policy if any, your pension plan if any, your
>highschool headmaster if any)
>
>//Jyrki

I've always been a little bit curious about the silliness of restricting
the "export" of information that's publicly available.  If our government
actually believed that there existed public information that wasn't
exportable/exported, I'd be quite surprised.

The attached information clearly states that publicly available software
is freely exportable.  There aren't ANY weasel words about types of software.

Now of course, the usual disclaimer "I'm not a lawyer, don't try this at home"
applies, but jeez, common sense sometimes applies in the world.

Regards,
Ed Hamrick


-------------------------------------------------------------------------

   Question G(1):  Does General License GTDA authorize the export of software
in machine readable code when the source code for such software is publicly
available?
   Answer:  If the source code of a software program is publicly available,
then the machine readable code compiled from the source code is software that
is publicly available and therefore eligible for General License GTDA.

-------------------------------------------------------------------------

     NOTE: The following includes the "General License GTDA: Technical
Data Available to All Destinations" portion of the U.S. Department of
Commerce Export Administration Regulations, as modified and effective
October 3, 1989.  For further information, contact Jim Seevaratnum,
Bureau of Export Administration, (202) 377-5695.


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .


PART 779 - (AMENDED)

   1.  The authority citation for 15 CFR part 779 continues to read as
follows:

   Authority:  Pub. L. 96-72, 93 Stat. 503 (50 U.S.C. app. 2401 et seq.), as
amended by Pub. L. 97-145 of Dec. 29, 1981, by Pub. L. 99-64 of July 12, 1985,
and by Pub. L. 100-418 of Aug. 23, 1988; E.O. 12525 of July 12, 1985 (50 FR
28757, July 16, 1985); Pub. L. 95-223 of Dec. 28, 1977 (50 U.S.C. 1701 et
seq); E.O. 12532 of Sept. 9, 1985 (50 FR 36861, Sept, 10, 1985) as affected by
notice of Sept. 4, 1986 (51 FR 31925, Sept. 8, 1986); Pub. L. 99-440 of Oct.
2, 1986 (22 U.S.C. 5001 et seq); and E.O. 12571 of Oct. 27, 1986 (51 FR 39505,
Oct. 29, 1986).

   2.  Section 779.3 is revised to read as follows:

$ 779.3  General license GTDA; technical data available to all destinations

   Note:  in this $ 779.3 the word "information" means "technical data" as
defined in $ 779.1 including software

(a) Establishment of general license.  A General License GTDA is hereby
established authorizing:
   (1) Unrestricted export to any destination of information that is already
publicly available or will be made publicly available as described in
paragraph (b) of this section;
   (2) Unrestricted export to any destination of information arising during or
resulting from fundamental research, as described in paragraph (c) of this
section;

   Note:  Paragraphs (a)(1) and (a)(2) of this section do not authorize the
export of data contained in a patent application for purposes of filing and/or
publishing for opposition abroad.  Such exports are controlled by the U.S.
Patent and Trademark Office and must be licensed by that office.  See EAR $
770.10(j).

   (3) Release of educational information, as described in paragraph (d) of
this section; and
   (4) Export of information in connection with certain patent applications,
as described in paragraph (e) of this section.

   Note 1:  See paragraph (1) regarding Government sponsored research covered
by contractual national security controls and the note following this section
regarding consulting and training.  Use of General License GTDA is subject to
the prohibitions of $ 771.2(C) (1), (4), and (9), but not to the other
prohibitions of $ 771.2 (c).

   Note 2:  Supplement No. 5 to part 779 contains explanatory questions and
answers about the use of General License GTDA.  Certain paragraphs of this $
779.3 are followed by references to relevant questions and answers in
supplement No. 5.

   (b) Publicly available.  Information is made public and so becomes
"publicly available" when it becomes generally accessible to the interested
public in any form, including:
   (1) Publication in periodicals, books, print, electronic, or any other
media available for general distribution to any member of the public or to a
community of persons, such as those in a scientific or engineering discipline,
interested in the subject matter either free or at a price that does not
exceed the cost of reproduction and distribution (see Questions A(1) through
A(6));
   (2) Ready availability at libraries open to the public or at university
libraries (see Question A(6));
   (3) Patents available at any patent office; and
   (4) Release at an open conference, meeting, seminar, trade show, or other
open gathering.
   (i) A conference or other gathering is "open" if all technically qualified
members of the public are eligible to attend and attendees are permitted to
take notes or otherwise make a personal record (not necessarily a recording)
of the proceedings and presentations.
   (ii) All technically qualified members of the public may be considered
eligible to attend a conference or other gathering notwithstanding:
   (A) A registration fee reasonably related to costs and reflecting an
intention that all interested and technically qualified persons be able to
attend, or
   (B) A limitation on actual attendance, as long as attendees either are the
first who have applied or are selected on the basis of relevant scientific or
technical competence, experience, or responsibility (see Questions B(1)
through B(6)).

This General License GTDA authorizes submission of papers to domestic or
foreign editors or reviewers of journals, or to organizers of open conferences
or other open gatherings, with the understanding that the papers will be made
publicly available if favorably received.  (See Questions A(1) and A(3).)
   (c) Information resulting from fundamental research--(1) Fundamental
research.  Paragraphs (c)(2) through (c)(4) and paragraph (f) of this section
provide specific operational rules that will be used to determine whether
research in particular institutional contexts qualifies as "fundamental
research."  The intent behind those operational rules is to identify as
"fundamental research" basic and applied research in science and engineering,
where the resulting information is ordinarily published and shared broadly
within the scientific community.  Such research can be distinguished from
proprietary research and from industrial development, design, production, and
product utilization, the results of which ordinarily are restricted for
proprietary reasons or specific national security reasons as defined in $
779.3(f).  (See Question D(8).)
   (2) University-based research. (i)  Research conducted by scientists,
engineers, or students at a university normally will be considered fundamental
research, as described below.  ("University" means any accredited institution
of higher education located in the United States.)
   (ii) Prepublication review by a sponsor of university research solely to
ensure that publication would not inadvertently divulge proprietary
information that the sponsor has furnished to the researchers does not change
the rule described in paragraph (c)(2)(i) of this section.  However, General
License GTDA does not authorize the release of information from a corporate
sponsor to university researchers where the research results are subject to
prepublication review.  See other sections in this part 779 for provisions
that may authorize such releases without a validated license.  (See Questions
D(7), D(9), and D(10).)
   (iii) Prepublication review by a sponsor of university research solely to
ensure that publication would not compromise patent rights does not change the
rule described in paragraph (c)(2)(i) of this section, so long as the review
causes no more than a temporary delay in publication of the research results.
   (iv) However, General License GTDA does not authorize the initial transfer
of information from an industry sponsor to university researchers where the
parties have agreed that the sponsor may withhold from publication some or all
of the information so provided.  (See Question D(2).)
   (v) University based research is not considered "fundamental research" if
the university or its researchers accept (at the request, for example, of an
industrial sponsor) other restrictions on publication of scientific and
technical information resulting from the project or activity.  Scientific and
technical information resulting from the research will nonetheless become
subject to General License GTDA once all such restrictions have expired or
have been removed.  (See Questions D(7) and D(9).)
   (vi) The provisions of paragraph (f) of this section will apply if a
university or its researchers accept specific national security controls (as
defined in paragraph (f) of this section) on a research project or activity
sponsored by the U.S. Government.  (See Questions E(1) and E(2).)
   (3) Research based at Federal agencies or FFRDCs.  Research conducted by
scientists or engineers working for a Federal agency or a Federally Funded
Research and Development Center (FFRDC) may be designated as "fundamental
research" within any appropriate system controlling release of information by
such scientists and engineers devised by the agency or the FFRDC.  (See
Questions D(8) and D(11).)
   (4) Corporate research. (i) Research conducted by scientists or engineers
working for a business entity will be considered "fundamental research" at
such time and to the extent that the researchers are free to make scientific
and technical information resulting from the research publicly available
without restriction or delay based on proprietary concerns or specific
national security controls as defined in paragraph (f) of this section.
   (ii) Prepublication review by the company solely to ensure that the
publication would compromise no proprietary information provided by the
company to the researchers is not considered to be a proprietary restriction
under paragraph (c)(4)(i) of this section.  However General License GTDA does
not authorize the release of information to university researchers where the
research results are subject to prepublication review.  See other sections in
this part 779 for provisions that may authorize such releases without a
validated license.  (See Questions D(8), D(9), and D(10).)
   (iii) Prepublication review by the company solely to ensure that
prepublication would compromise no patent rights will not be considered a
proprietary restriction for this purpose, so long as the review causes no more
than a temporary delay in publication of the research results.
   (iv) However, General License GTDA does not authorize the initial transfer
of information from a business entity to researchers where the parties have
agreed that the business entity may withhold from publication some or all of
the information so provided.
   (5) Research based elsewhere.  Research conducted by scientists or
engineers who are not working for any of the institutions described in
paragraphs (c)(2) through (c)(4) of this section will be treated as corporate
research, as described in paragraphs (c)(2) through (c)(4) of this section
will be treated as corporate research, as described in paragraph (c)(4) of
this section.  (See Question D(8)).
   (d) Educational information.  The release of "educational information"
referred to in paragraph (a)(3) of this section is release by instruction in
catalog courses and associated teaching laboratories of academic institutions.
Dissertation research is treated in paragraph (c)(2) of this section.  (See
Question C(1) through C(6).)
   (e) Patent applications.  The information referred to in paragraph (a)(4)
of this section is:
   (1) Information contained in a patent application prepared wholly from
foreign-origin technical data where the application is being sent to the
foreign inventor to be executed and returned to the United States for
subsequent filing in the U.S. Patent and Trademark office;
   (2) Information contained in a patent application, or an amendment,
modification, supplement, or division of an application, and authorized for
filing in a foreign country in accordance with the regulations of the Patent
and Trademark Office, 37 CFR part 5 (see $ 770.10(j)); or
   (3) Information contained in a patent application when sent to a foreign
country before or within six months after the filing of a United States patent
application for the purpose of obtaining the signature of an inventor who was
in the United States when the invention was made or who is a co-inventor with
a person residing in the United States.
   (f) Government-sponsored research covered by contract controls. (1) If
research is funded by the U.S. Government, and specific national security
controls are agreed on to protect information resulting from the research,
paragraph (a)(2) of this section will not apply to any export of such
information in violation of such controls.  General License GTDA as described
in paragraph (a)(2) of this section is nonetheless available for any export of
information resulting from the research that is consistent with the specific
controls.
   (2) Examples of "specific national security controls" include requirements
for prepublication review by the Government, with right to withhold permission
for publication; restrictions on prepublication dissemination of information
to non-U.S. citizens or other categories of persons; or restrictions on
participation of non-U.S. citizens or other categories of persons in the
research.  A general reference to one or more export control laws or
regulations or a general reminder that the Government retains the right to
classify is not a "specific national security control". (See Questions E(1)
and E(2).)
   (g) Advice concerning uncontrolled information.  Persons may be concerned
that an export of uncontrolled information could adversely affect U.S.
national security interests.  Exporters who wish advice before exporting such
information can contact the appropriate Government scientific or technical
personnel by calling the Bureau of Export Administration at (202) 377-4811.

   Note:  Consulting and training.  Technical data can be inadvertently
exported in various ways.  Consulting and training are especially effective
mechanisms of technology transfer.  The exporter should be aware that the
Department of Commerce maintains controls on exports of technical data that do
not qualify for General License GTDA as described in paragraphs (a)(1) through
(a)(3) of this section, including application abroad of personal knowledge or
technical experience acquired in the United States.  (See also paragraph (g)
of this section and Question F(1).)

(Approved by the Office of Management and Budget under control number 065-
0011)

3. A new supplement No. 5 to part 779 is added to read as follows:

Supplement No. 5 to Part 779--Questions and answers--General License GTDA

   This supplement No. 5 contains explanatory questions and answers about
General License GTDA.  This Supplement is divided into six sections according
to topic as follows:

   Section A: Publication of technical data and exports of technical data that
has been or will be published.
   Section B: Release of technical data at conferences.
   Section C: Educational instruction.
   Section D: Research, correspondence, and informal scientific exchanges.
   Section E: Federal contract controls.
   Section F: Commercial consulting.
   Section G: Software.
   Section H: Available in a public library.
   Section I: Miscellaneous

Section A:  Publication

   Question A(1):   I plan to publish in a foreign Journal a scientific paper
describing the results of my research, which is in a area listed in $
779.4(d).  Do I need a validated license?
   Answer:   No.  General License GTDA permits unrestricted export to any
destination not only of technical data that are already publicly available,
but of technical data that are made public by the transaction in question ($
779.3(a)(1)).  Your research results would be made public by the planned
publication.  You would not need a validated license.
   Question A(2):   Would the answer differ depending on where I work or where
I performed the research?
   Answer:   No.  Of course, the General License would not relieve you from
any restrictions on publications that your employer or another sponsor of your
research may have imposed.
   Question A(3):   Would it make any difference if I published in a foreign
journal?  Would I need a validated license to send the paper to the editors
for review?
   Answer:    No to both questions.  General license GTDA authorizes
submission of papers to editors or reviewers of journals, including foreign
journals, if the intention is that the papers will be published if favorably
received $ 779.3(b), last paragraph).
   Question A(4):    The research on which I will be reporting in my paper is
supported by a grant from the Department of Energy.  The grant requires
prepublication clearance by DOE:  Does that make any difference under the
Export Administration Regulations?
   Answer:    No; GTDA would still apply.  But if you publish in violation of
the controls you have accepted in the Grant, you will be subject to
appropriate administrative, civil, and possible criminal sanctions under other
laws.
   Question A(5):    We provide consulting services on the design, layout, and
construction of integrated circuit plants and production lines.  A major part
of our business is the publication for sale to clients of detailed handbooks
and reference manuals on key aspects of the design and manufacturing
processes.  A typical cost of publishing such a handbook and manual might be
$500; the typical sales price is around $15,000.  Does general license GTDA
cover publication and sale of such handbooks or manuals?
   Answer:    No.  The price is above the cost of reproduction and
distribution ($ 779.3(b)(1)).  Thus, you would need some other form of license
before you could export any of these handbooks or manuals.
   Question A(6):    My Ph.D. thesis on a subject listed in $ 779.4(d) has
never been published for general distribution.  However, it is available at
the institution from which I took the degree.  Do I need a validated license
to send another copy to a colleague overseas?
   Answer:    That may depend on where in the institution it is available.  It
is is not readily available in the university library (e.g., by filing in open
stacks with a reference in the catalog), it is not "publicly available" and
the GTDA license would not be available on that ground.  The GTDA license
would still be applicable if you Ph.D. research qualified as "fundamental
research" under $ 779.3(c).  If not, however, you will need some other form of
license before you can send a copy out of the country.
   Question A(7) :  We sell electronically recorded information, including
software and databases, at wholesale and retail.  Our products are available
by mail order to any member of the public, though intended for specialists in
various fields.  They are priced to maximize sales to persons in those fields.
Do we need validated license to sell our products to foreign customers?
   Answer:   You would not need a validated license for otherwise controlled
technical data or software if the technical data and software are made
publicly available at a price that does not exceed the cost of production and
distribution to the technical community.  Even if priced at a higher level,
General License GTDA authorizes the export if the technical data or software
source code is in a library accessible to the public. ($ 779.3(b)(1).

Section B:  Conferences

   Question B(1):  I have been invited to give a paper at a prestigious
international scientific conference on a subject listed in $ 779.4 (d).
Scientists in the field are given an opportunity to submit applications to
attend.  Invitations are given to those judged by a panel of scientific peers
to be the leading researchers in the field, and attendance is by invitation
only.  Attendees will be free to take notes, but not make electronic or
verbatim recordings of the presentation or discussions.  Some of the attendees
will be foreigners.  Do I need a validated license to give my paper?
   Answer:  No.  General License GTDA is available for release of information
at an open conference.  The conference you describe fits the definition of an
open conference ($ 779.3(a)(1) and (b)(4)).
   Question B(2):  Would it make any difference if there were a prohibition on
making any notes or other personal record of what transpires at the
conference?
   Answer:  Yes.  To qualify as an "open" conference, attendees must be
permitted to take notes or otherwise make a personal record (although not
necessarily a recording).  If note taking or the making of personal records is
altogether prohibited, the conference would not be considered "open."
   Question B(3):  Would it make any difference if there were also a
registration fee?
   Answer:  That would depend on whether the fee is reasonably related to
costs and reflects an intention that all interested and technically qualified
persons should be able to attend ($ 779.3 (b)(4)(ii)(A)).
   Question B(4):  Would it make any difference if the conference were to take
place in another country?
   Answer:  No.
   Question B(5):  Must I have a validated license to send the paper I propose
to present at such a foreign conference to the conference organizer for
review?
   Answer:  No. General license GTDA authorizes submission of papers to
foreign organizers of open conferences or other open gatherings with the
intention that the papers will be delivered at the conference, and so made
publicly available, if favorably received ($ 779.3(b), last paragraph).
   Question B(6):  Would the answers to any of the foregoing questions be
different if my work were supported by the Federal Government?
   Answer:  No.  You may use GTDA to export the papers, even if the release of
the paper violates any agreements you have made with your government sponsor.
However, nothing in the Export Administration Regulations relieves you of
responsibility for conforming to any controls you have agreed to in your
Federal grant or contract.

Section C:  Educational Instruction

   Question C(1):  IU teach a university graduate course on design and
manufacture of very high-speed integrated circuitry.  Many of the students are
foreigners.  Do I need a validated license to teach this course?
   Answer:  No. Release of information by instruction in catalog courses and
associated teaching laboratories of academic institutions is licensed under
general license GTDA ($ 779.3(d)).
   Question C(2):  Would it make any difference if some of the students were
from Communist Bloc countries?
   Answer:  No.
   Question C(3):  Would it make any difference if I talk about recent and as
yet unpublished results from my laboratory research?
   Answer:  No.
   Question C(4):  Even if that research is funded by the Government?
   Answer:  Even then the general license would apply, but the export
Administration Regulations would not release you from any separate obligations
you have accepted in your grant or contract.
   Question C(5):  Would it make any difference if I were teaching at a
foreign university?
   Answer:  No.
   Question C(6):  We teach proprietary courses on design and manufacture of
high-performance aircraft and missles.  Is the instruction in our classes
covered by the GTDA license?
   Answer:  That instruction would not qualify as "release of educational
information" under $ 779.3(a)(3) because your proprietary business does not
qualify as an "academic institution" within the meaning of $ 779.3(d).
Conceivably, however, the instruction might qualify as "release at an open ***
seminar, *** or other open gathering" under $ 779.3 (b)(4).  The conditions
for qualification of such a seminar or gathering as "open," including a fee
"reasonably related to costs (of the conference, not of producing the data)
and reflecting an intention that all interested and technically qualified
persons be able to attend," would have to be satisfied.

Section D:  Research, Correspondence, and Informal Scientific Exchanges

   Question D(1):  Do I need a validated license in order for a foreign
graduate student to work in my laboratory?
   Answer:  Not if the research on which the foreign student is working
qualifies as "fundamental research" under $ 779.3(c).  In that case, the GTDA
general license is available.
   Question D(2):  Our company has entered into a cooperative research
arrangement with a research group at a university.  One of the researchers in
that group is a Polish national.  We would like to share some of our
proprietary information with the university research group.  We have no way of
guaranteeing that this information will not get into the hands of the Polish
scientist.  Do we need to obtain a validated license to protect against that
possibility?
   Answer:  No.  General License GTDA authorizes the disclosure of information
to any scientists, engineers, or students at a U.S. university in the course
of industry-university research collaboration under specific arrangements
between a firm and the university, provided these arrangements do not permit
the sponsor to withhold from publication any of the information that he
provides to the researchers.  However, if your company and the researchers
have agreed to a prohibition on publication, then you must qualify for another
general license or obtain a validated license before transferring the
information to the university.  It is important that you as the corporate
sponsor and the university get together to discuss whether foreign nationals
will have access to the information, so that you may obtain any necessary
export authorization prior to transferring the information to the research
team.
   Question D(3):  My university will host a prominent scientist from the
Soviet Union who is an expert on research in engineered ceramics and composite
materials.  Do I require a validated license before telling our visitor about
my latest, as yet unpublished, research results in those fields?
   Answer:   Probably not.  If you performed your research at the university,
and you were subject to no contract controls on release of research results
agreed to with a sponsor of the research, your research would qualify as
"fundamental research" ($ 779.3(c)(2)).  Unrestricted export of information
arising during or resulting from such research is covered by general license
GTDA (779.3(a)(2)).  You should probably assume, however, that your visitor
will be debriefed later about anything of potential military value he learns
from you.  If you are concerned that giving such information to him, even
through licensed, could jeopardize U.S. security interests, the Commerce
Department can put you in touch with appropriate Government scientists who can
advise you.  Write to Department of Commerce, Bureau of Export Administration,
Office of Technology and Policy Analysis, P.O. Box 273, Washington, D.C.
20044.
   Question D(4):  Would it make any difference if I were proposing to talk
with a Soviet expert in the Soviet Union?
   Answer:  No, if the information in question arose during or resulted from
the same "fundamental research."
   Question D(5):  Could I properly do some work with him in his research
laboratory inside the Soviet Union?
   Answer:  Application abroad of personal knowledge or technical experience
acquired in the United States constitutes an export of that knowledge and
experience, and such an export is subject to the Export Administration
Regulations ($ 779.1(b)(1)(iii) and (2)(iii) and $ 779.2).  Such an export
must be licensed.  If any of the knowledge or experience you export in this
way is not covered by general license, you would need a validated license.
   Question D(6):  I would like to correspond and share research results with
a Soviet-Bloc expert in my field, which is listed in $ 779.4(d).  Do I require
a validated license to do so?
   Answer:  Not as long as we are still talking about information that arose
during or resulted from research that qualifies as "fundamental" under the
rules spelled out in $ 779.3(c).
   Question D(7):  Suppose the research in question were funded by a corporate
sponsor and I had agreed to prepublication review of any paper arising from
the research?
   Answer:  Whether your research would still qualify as "fundamental" would
depend on the nature and purpose of the prepublication review.  If the review
is intended solely to ensure that your publications will neither compromise
patent rights nor advertently divulge proprietary information that the sponsor
has furnished to you, the research could still qualify as "fundamental."  But
if the sponsor will consider as part of its prepublication review whether it
wants to hold your new research results as trade secrets or otherwise
proprietary information (even if your voluntary cooperation would be needed
for it to do so), your research would no longer qualify as "fundamental."  As
used in these regulations it is the actual and intended openness of research
results that primarily determines whether the research counts as "fundamental"
and so comes under general license GTDA.
   Question D(8):  In determining whether research is thus open and therefore
counts as "fundamental," does it matter where or in what sort of institution
the research is performed?
   Answer:  In principle, no.  "Fundamental research" is performed in
industry, Federal laboratories, or other types of institutions, as well as in
universities.  The regulations introduce some operational presumptions and
procedures that can be used both by those subject to the regulations and by
those who administer them to determine with some precision whether a
particular research activity is covered.  Recognizing that common and
predictable norms operate in different types of institutions, the regulations
use the institutional locus of the research as a starting point for these
presumptions and procedures.  Nonetheless, it remains the type of research,
and particularly the intent and freedom to publish, that identifies
"fundamental research"--not the institutional locus ($ 779.3(C)).
   Question D(9):  I am doing research on high-powered lasers in the central
basic-research laboratory of an industrial corporation.  I am required to
submit the results of my research for prepublication review before I can
publish them or otherwise make them public.  I would like to compare research
results with a scientific colleague from an East Bloc country and discuss the
results of the research with her when she visits the United States.  Do I need
a validated license to do so?
   Answer:  You probably do need a validated license ($ 779.3(c)(4)).
However, if the only restriction on your publishing any of that information is
a prepublication review solely to ensure that publication would compromise no
patent rights or proprietary information provided by the company to the
researcher, your research may be considered "fundamental research," in which
case you may be able to share information under the GTDA general license.
Note that GTDA will not be available if the prepublication review is intended
to withhold the results of the research from publication.
   Question D(10):  Suppose I have already cleared my company's review process
and am free to publish all the information I intend to share with my
colleague, though I have not yet published?
   Answer:  If the clearance from your company means that you are free to make
all the information publicly available without restriction or delay, the GTDA
license will apply and you will not need a validated license for this exchange
($ 779.3(c)(4)).
   Question D(11):  I work as a researcher at a Government-owned, contractor-
operated research center.  May I share the results of my unpublished research
with foreign nationals without concern for export controls under the Export
Administration Regulations?
   Answer:  That is up the sponsoring agency and the center's management.  If
your research is designated "fundamental research" within any appropriate
system devised by them to control release of information by scientists and
engineers at the center, it will be treated as such by the Commerce
Department, and the GTDA license will apply.  Otherwise, you would need some
other form of license, except to publish or otherwise make the information
public ($ 779.3(c)(3)).

Section E:  Federal Contract Controls

   Question E(1):  In a contract for performance of research entered into with
the Department of Defense, we have agreed to certain national security
controls.  DOD is to have ninety days to review any papers we proposed before
they are published and must approve assignment of any foreign nationals to the
project.  The work in question would otherwise qualify as "fundamental
research" under $ 779.3(c).  Does the GTDA license cover information arising
during or resulting from this sponsored research?
   Answer:  Any "export" inconsistent with the controls you have agreed to
will not qualify for export under GTDA as "fundamental research."  Any
"export" consistent with the controls will qualify for export under GTDA as
"fundamental research."  Thus, if you abide by the specific controls you have
agreed to, you need not be concerned about violating the Export Administration
Regulations.  If you violate those controls and export information as
"fundamental research" under $ 779.3(c), you may subject yourself to the
sanctions provided for under the Export Administration Regulations, including
criminal sanctions, in addition to administrative and civil remedies for
breach of contract.
   Question E(2):  Do the Export Administration Regulations restrict my
ability to publish the results of my research?
   Answer:  The Export Administration Regulations are not the means for
enforcing the national security controls you have agreed to.  If such a
publication violates the contract, you would be subject to administrative,
civil, and possible criminal penalties under other law.

Section F:  Commercial Consulting

   Question F(1):  I am a professor at a U.S. university, with expertise in
design and creation of submicron devices.  I have been asked to be a
consultant for a "third-world" company that wishes to manufacture such
devices.  Do I need a validated license to do so?
   Answer:  Quite possibly you do.  Application abroad of personal knowledge
or technical experience acquired in the United States constitutes an export of
that knowledge and experience that is subject to the Export Administration
Regulations ($ 779.1(b)(1)(iii) and (2)(iii), and $ 779.2).  Such an export
must be licensed.  If any part of the knowledge or experience you export in
this way is not covered by general license, you would need a validated
license.

Section G:  Software

   Question G(1):  Does General License GTDA authorize the export of software
in machine readable code when the source code for such software is publicly
available?
   Answer:  If the source code of a software program is publicly available,
then the machine readable code compiled from the source code is software that
is publicly available and therefore eligible for General License GTDA.
   Question G(2):  Does General License GTDA authorize the export of software
sold at a price that does not exceed the cost of reproduction and
distribution?
   Answer:  Software in machine readable code is publicly available if it is
available to a community at a price that does not exceed the cost of
reproduction and distribution.  Such reproduction and distribution costs may
include variable and fixed allocations of overhead and normal profit for the
reproduction and distribution functions either in your company or in a third
party contribution system.  In your company, such costs may not include
recovery for development, design, or acquisition.  In this case, the provider
of the software does not receive a fee for the inherent value of the software.
   Question G(3):  Does General License GTDA authorize the export of software
sold at a price BXA concludes in a classification letter to be sufficiently
low to qualify the particular software for General License GTDA?
   Answer:  In response to classification requests, BXA may choose to classify
certain software as eligible for General License GTDA even though it is sold
at a price above the costs of reproduction and distribution as long as the
price is nonetheless sufficiently low to qualify for such a classification in
the judgement of BXA.

Section H:  Available in a Public Library

   Question H(1):  Does General License GTDA authorize the export of
information available in a library and sold through an electronic or print
service?
   Answer:  Electronic and print services for the distribution of information
may be relatively expensive in the marketplace because of the value venders
add in retrieving and organizing information in a useful way.  If such
information is also available in a library--itself accessible to the public--
or has been published in any way, that information is "publicly available" for
those reasons, and the information itself remains eligible for General License
GTDA even though you access the information through an electronic or print
service for which you or your employer pay a substantial fee.
   Question H(2):  Does General License GTDA authorize the export of
information available in an electronic form in a library at no charge to the
library patron?
   Answer:  Information available in an electronic form at no charge to the
library patron in a library accessible to the public is information publicly
available even though the library pays a substantial subscription fee for the
electronic retrieval service.
   Question H(3):  Does General License GTDA authorize the export of
information available in a library and sold for more than the cost of
reproduction and distribution?
   Answer:  Information from books, magazines, dissertations, papers,
electronic data bases, and other information available in a library that is
accessible to the public qualifies for General License GTDA.  This is true
even if you purchase such a book at more than the cost of reproduction and
distribution.  In other words, such information is "publicly available" even
though the author makes a profit on your particular purchase for the inherent
value of the information.

Section I:  Miscellaneous

   Question I(1):  The manufacturing plant that I work at is planning to begin
admitting groups of the general public to tour the plant facilities.  We are
concerned that an export license might be required if the tour groups include
foreign nationals.  Would such a tour constitute an export?  If so, does
General License GTDA authorize this type of export?
   Answer:  EAR $ 779.1(b) defines exports of technical data to include
release through visual inspection by foreign nationals of U.S.-origin
equipment and facilities.  Consequently, you must obtain export authorization
prior to permitting foreign nationals to tour your facilities.  Such an export
qualifies under the "publicity available" provision of General License GTDA so
long as the tour is truly open to all members of the public, including your
competitors, and you do not charge a fee that is not reasonably related to the
cost of conducting the tours ($ 779.3(a)(1)).
   Question I (2):  Does General License GTDA authorize the export of
information not in a library or published, but sold at a price that does not
exceed the cost of reproduction and distribution?
   Answer:  Information that is not in a library accessible to the public and
that has not been published in any way, may nonetheless become "publicly
available" if you make it both available to a community of persons and if you
sell it at no more than the cost of reproduction and distribution.  Such
reproduction and distribution costs may include variable and fixed cost
allocations of overhead and normal profit for the reproduction and
distribution functions either in your company or in a third party distribution
system.  In your company, such costs may not include recovery for development,
design, or acquisition of the technical data or software.  The reason for this
conclusion is that the provider of the information receives nothing for the
inherent value of the information.
   Question I(3):  Does General License GTDA authorize the export of
information contributed to an electronic bulletin board?
   Answer:  Assume each of the following:
   1.  Information is uploaded to an electronic bulletin board by a person
that is the owner or originator of the information;
   2.  That person does not charge a fee to the bulletin board administrator
or the subscribers of the bulletin board; and
   3.  The bulletin board is available for subscription to any subscriber in a
given community regardless of the cost of subscription.
   Such information is "publicly available" and therefore eligible for General
License GTDA even if it is not elsewhere published and is not in a library.
The reason for this conclusion is that the bulletin board subscription charges
or line charges are for distribution exclusively, and the provider of the
information receives nothing for the inherent value of the information.
   Question I(4):  Does General License GTDA authorize the export of patented
information fully disclosed on the public record?
   Answer:  Information to the extent it is disclosed on the patent record
open to the public is eligible for General License GTDA even though you may
use such information only after paying a fee in excess of the costs of
reproduction and distribution.  In this case the seller does not receive a fee
for the inherent value of the technical data; however, General License GTDA is
nonetheless available because any person can obtain the technical data from
the public record and further disclose or publish the information.  For that
reason, it is impossible to impose export controls that deny access to the
information.

Dated:  September 25, 1989.

James M. LeMunyon,

Deputy Assistant Secretary for Export Administration

[FR Doc. 89-23046 Filed 10-2-89; 8:45 a.m.]

Billing Code 3510-DT-M

In article <1993Jan07.075317.15435@convex.com> hamrick@convex.com (Ed Hamrick) writes:
>The attached information clearly states that publicly available software
>is freely exportable.  There aren't ANY weasel words about types of software.

Unfortunately, the information attached applies specifically to the
Commerce Department's "Core List" controls, *not* to the State
Department's ITARs (International Traffic in Arms Regulations). In
theory, the Core List controls "dual use" technologies (stuff with
both military and civilian uses, general purpose computer hardware
being the classic example) while the ITARs are supposed to regulate
only munitions (i.e., pure weapons, a Stinger missile being the
classic example.)

Unfortunately, the government can't seem to decide which category
(dual use/munition) crypto belongs in. ("It's a floor wax! No, it's a
dessert topping!") So in classic bureaucratic fashion, *both* sets of
export controls mention it. And to make things even more fun, there's
something called a "Commodity Jurisdiction Request" you can file in
this institutionalized turf war between State and Commerce to have
them battle out which set of rules applies to *your* proposed crypto
export.

In practice, whenever crypto is involved, NSA makes the determination.
If they can't crack it, they tell State to rule that it's ITAR
controlled, and thus not eligible for any of the Commerce Dept's
general licenses. If you don't like the determination, about the only
way you can get NSA to change it is to show them, step by step, how to
crack your cipher. This can include describing the Berlekamp-Massey
algorithm to them.

Your tax dollars at work.

Phil

In article <1993Jan07.075317.15435@convex.com> hamrick@convex.com (Ed Hamrick) writes:
>
>The attached information clearly states that publicly available software
>is freely exportable.  There aren't ANY weasel words about types of software.

My reading of the English language seems to be somewhat different
from Ed Hamrick's. His quoted material is shot through with what he
calls "weasel words" and restrictions of all sorts, and is not as
open and shut as he would like to make it seem. Apologies for not
editing more than I've done--I'm only trying to show various
kinds of restrictions in the language. Not all apply to the current
case:

>   Note:  Paragraphs (a)(1) and (a)(2) of this section do not authorize the
>export of data contained in a patent application for purposes of filing and/or
>publishing for opposition abroad.  Such exports are controlled by the U.S.
>Patent and Trademark Office and must be licensed by that office.  See EAR $
>770.10(j).
>
>   Note 1:  See paragraph (1) regarding Government sponsored research covered
>by contractual national security controls and the note following this section
>regarding consulting and training.  Use of General License GTDA is subject to
>the prohibitions of $ 771.2(C) (1), (4), and (9), but not to the other
>prohibitions of $ 771.2 (c).
>
>However, General
>License GTDA does not authorize the release of information from a corporate
>sponsor to university researchers where the research results are subject to
>prepublication review.  See other sections in this part 779 for provisions
>that may authorize such releases without a validated license.  (See Questions
>D(7), D(9), and D(10).)
>   (iv) However, General License GTDA does not authorize the initial transfer
>of information from an industry sponsor to university researchers where the
>parties have agreed that the sponsor may withhold from publication some or all
>of the information so provided.  (See Question D(2).)
>   (vi) The provisions of paragraph (f) of this section will apply if a
>university or its researchers accept specific national security controls (as
>defined in paragraph (f) of this section) on a research project or activity
>sponsored by the U.S. Government.  (See Questions E(1) and E(2).)

>without restriction or delay based on proprietary concerns or specific
>national security controls as defined in paragraph (f) of this section.
>   (ii) Prepublication review by the company solely to ensure that the
>publication would compromise no proprietary information provided by the
>company to the researchers is not considered to be a proprietary restriction
>under paragraph (c)(4)(i) of this section.  However General License GTDA does
>not authorize the release of information to university researchers where the
>research results are subject to prepublication review.  See other sections in
>this part 779 for provisions that may authorize such releases without a
>validated license.  (See Questions D(8), D(9), and D(10).)

>   (iv) However, General License GTDA does not authorize the initial transfer
>of information from a business entity to researchers where the parties have
>agreed that the business entity may withhold from publication some or all of
>the information so provided.

>   (f) Government-sponsored research covered by contract controls. (1) If
>research is funded by the U.S. Government, and specific national security
>controls are agreed on to protect information resulting from the research,
>paragraph (a)(2) of this section will not apply to any export of such
>information in violation of such controls. 

>   (2) Examples of "specific national security controls" include requirements
>for prepublication review by the Government, with right to withhold permission
>for publication; restrictions on prepublication dissemination of information
>to non-U.S. citizens or other categories of persons; or restrictions on
>participation of non-U.S. citizens or other categories of persons in the
>research.  A general reference to one or more export control laws or
>regulations or a general reminder that the Government retains the right to
>classify is not a "specific national security control". (See Questions E(1)
>and E(2).)

>   (g) Advice concerning uncontrolled information.  Persons may be concerned
>that an export of uncontrolled information could adversely affect U.S.
>national security interests.  Exporters who wish advice before exporting such
>information can contact the appropriate Government scientific or technical
>personnel by calling the Bureau of Export Administration at (202) 377-4811.
>
> The exporter should be aware that the
>Department of Commerce maintains controls on exports of technical data that do
>not qualify for General License GTDA as described in paragraphs (a)(1) through
>(a)(3) of this section, including application abroad of personal knowledge or
>technical experience acquired in the United States.  (See also paragraph (g)
>of this section and Question F(1).)

>   Question A(2):   Would the answer differ depending on where I work or where
>I performed the research?
>   Answer:   No.  Of course, the General License would not relieve you from
>any restrictions on publications that your employer or another sponsor of your
>research may have imposed.

>   Question A(4):    The research on which I will be reporting in my paper is
>supported by a grant from the Department of Energy.  The grant requires
>prepublication clearance by DOE:  Does that make any difference under the
>Export Administration Regulations?
>   Answer:    No; GTDA would still apply.  But if you publish in violation of
>the controls you have accepted in the Grant, you will be subject to
>appropriate administrative, civil, and possible criminal sanctions under other
>laws.

> nothing in the Export Administration Regulations relieves you of
>responsibility for conforming to any controls you have agreed to in your
>Federal grant or contract.
>
>   Question C(4):  Even if that research is funded by the Government?
>   Answer:   the export
>Administration Regulations would not release you from any separate obligations
>you have accepted in your grant or contract.

>
>   Question D(5):  Could I properly do some work with him in his research
>laboratory inside the Soviet Union?
>   Answer:  Application abroad of personal knowledge or technical experience
>acquired in the United States constitutes an export of that knowledge and
>experience, and such an export is subject to the Export Administration
>Regulations ($ 779.1(b)(1)(iii) and (2)(iii) and $ 779.2).  Such an export
>must be licensed.  If any of the knowledge or experience you export in this
>way is not covered by general license, you would need a validated license.

>   Question D(9):  I am doing research on high-powered lasers in the central
>basic-research laboratory of an industrial corporation.  I am required to
>submit the results of my research for prepublication review before I can
>publish them or otherwise make them public.  I would like to compare research
>results with a scientific colleague from an East Bloc country and discuss the
>results of the research with her when she visits the United States.  Do I need
>a validated license to do so?
>   Answer:  You probably do need a validated license ($ 779.3(c)(4)).
>
>Section E:  Federal Contract Controls
>
>   Question E(1):  In a contract for performance of research entered into with
>the Department of Defense, we have agreed to certain national security
>controls.  DOD is to have ninety days to review any papers we proposed before
>they are published and must approve assignment of any foreign nationals to the
>project.  The work in question would otherwise qualify as "fundamental
>research" under $ 779.3(c).  Does the GTDA license cover information arising
>during or resulting from this sponsored research?
>   Answer:  Any "export" inconsistent with the controls you have agreed to
>will not qualify for export under GTDA as "fundamental research."

> you may subject yourself to the
>sanctions provided for under the Export Administration Regulations, including
>criminal sanctions, in addition to administrative and civil remedies for
>breach of contract.

>   Question E(2):  Do the Export Administration Regulations restrict my
>ability to publish the results of my research?
>   Answer:  The Export Administration Regulations are not the means for
>enforcing the national security controls you have agreed to.  If such a
>publication violates the contract, you would be subject to administrative,
>civil, and possible criminal penalties under other law.
>
>Section F:  Commercial Consulting
>
>   Question F(1):  I am a professor at a U.S. university, with expertise in
>design and creation of submicron devices.  I have been asked to be a
>consultant for a "third-world" company that wishes to manufacture such
>devices.  Do I need a validated license to do so?
>   Answer:  Quite possibly you do.  Application abroad of personal knowledge
>or technical experience acquired in the United States constitutes an export of
>that knowledge and experience that is subject to the Export Administration
>Regulations ($ 779.1(b)(1)(iii) and (2)(iii), and $ 779.2).  Such an export
>must be licensed.  If any part of the knowledge or experience you export in
>this way is not covered by general license, you would need a validated
>license.
>

>information contributed to an electronic bulletin board?
>   Answer:  Assume each of the following:
>   1.  Information is uploaded to an electronic bulletin board by a person
>that is the owner or originator of the information;
NOTE CAREFULLY HERE THAT THE OWNER OF THE RSA MATERIALS IS RSA, NOT
AN UNLICENSED INFRINGER.

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

In article <C0GI7J.6so@wimsey.bc.ca> markh@wimsey.bc.ca (Mark C. Henderson) writes:
>In article <BURT.93Jan6093746@chirality.rsa.com> burt@chirality.rsa.com (Burt Kaliski) writes:
>>RSAREF is now available via anonymous FTP to 'rsa.com'. Along with
>>RSAREF you can get RIPEM, Mark Riordan's RSAREF-based privacy-enhanced
>>mail application, and an Emacs command interface to RIPEM. See the
>>file 'README' in the FTP directory 'rsaref' for more information.
>>
>>Sorry, U.S. persons only.
>>
>>-- Burt Kaliski
>>RSA Laboratories
>
>Why not Canadians?
>Considering that RSAREF has been distributed to Canadian citizens on
>Canadian hosts the past, it seems strange that we are excluded
>from distrubution via anonymous ftp from rsa.com

I received the following response from burt@rsa.com:

} Export law requires that we submit a shipping declaration whenever we
} send RSAREF to Canada. We can do this for email distribution, but not
} for anonymous FTP, because we don't know who took the software.
} Perhaps we could request that Canadians who take RSAREF via anonymous
} FTP send email saying so, but I'm not sure yet that this is good
} enough. (Although it's probably no worse than saying "don't take
} it if you're not in the U.S. or Canada.")
} 
} -- Burt

Oh well. I don't really see how RSADSI could get around this easily.

Mark
-- 
Mark Henderson
markh@wimsey.bc.ca
RIPEM key available by key server/finger/E-mail

In article <1993Jan07.075317.15435@convex.com>, hamrick@convex.com (Ed Hamrick) writes:
> I've always been a little bit curious about the silliness of restricting
> the "export" of information that's publicly available.  If our government
> actually believed that there existed public information that wasn't
> exportable/exported, I'd be quite surprised.

It is much like the difference between exporting a journal that explains
how to make gunpowder*, and exporting gunpowder.   The government isn't
blocking the "knowledge" of how to make gunpowder from being exported,
only its implmentation.

Gunpowder wasn't invented in the U.S., and lots of people outside the U.S.
are quite good at making it.  Some would say even better than those in
the U.S.  [Continue to the point of absurdity.]

*Gunpowder is just an example, replace it with any widely known thing on the
munitions list.


Software, and computers has made this distinction very fuzzy.  With computers
the software is the implementation.  The computer is just a hunk of gold-plated
junk without the software.  But then again, so is a chemical plant, until
you type in the right formula.
-- 
Sean Donelan, Data Research Associates, Inc, St. Louis, MO
Domain: sean@sdg.dra.com, Voice: (Work) +1 314-432-1100

In article <1993Jan6.224021.986@nntp.hut.fi> 
	jkp@cs.HUT.FI (Jyrki Kuoppala) writes:

>Could someone please post the copyright notices of the RIPEM and
>RSAREF packages (or possibly just the code) here?

How about the RSAREF README file, with all the restrictions, notices, 
license agreement, etc. (see below)
>
>(disclaimer: before doing so, you might want to check whether it is
>allowed by (including but not limited to) the U.S. government, the
>authors of the copyright notices, the Iraqi government, the Chinese
>government, any of the other governments of the countries in the
>world, your mother, your pets if any, your computer vendor if any,
>your insurance policy if any, your pension plan if any, your
>highschool headmaster if any)

Is it true that there's no Suomi word for toilet paper?

-----------------schnipp hier-----------------------------------------

                              RSAREF(TM):
          A Cryptographic Toolkit for Privacy-Enhanced Mail

                           RSA Laboratories
               (A division of RSA Data Security, Inc.)
                            March 3, 1992


This document copyright (C) 1992 RSA Laboratories, a division of RSA
Data Security, Inc. License is granted to reproduce, copy, post, or
distribute in any manner, provided this document is kept intact and
no modifications, deletions, or additions are made.


WHAT IS IT?

RSAREF is a cryptographic toolkit designed to facilitate rapid
deployment of Internet Privacy-Enhanced Mail (PEM) implementations.
RSAREF represents the fruits of RSA Data Security's commitment to the
U.S. Department of Defense's Advanced Research Projects Agency
(DARPA) to provide free cryptographic source code in support of a PEM
standard. RSA Laboratories offers RSAREF in expectation of PEM's
forthcoming publication as an Internet standard.

Part of RSA's commitment to DARPA was to authorize Trusted Information
Systems of Glenwood, MD, to distribute a full PEM implementation. That
implementation will be available this spring.

RSAREF supports the following PEM-specified algorithms:

     o    RSA encryption and key generation, as defined by RSA
            Laboratories' Public-Key Cryptography Standards (PKCS)

     o    MD2 and MD5 message digests

     o    DES (Data Encryption Standard) in cipher-block chaining mode

RSAREF is written in the C programming language as a library that can
be called from an application program. A simple PEM implementation
can be built directly on top of RSAREF, together with message parsing
and formatting routines and certificate-management routines. RSAREF
is distributed with a demonstration program that shows how one might
build such an implementation.

The name "RSAREF" means "RSA reference." RSA Laboratories intends
RSAREF to serve as a portable, educational, reference implementation
of cryptography.


WHAT YOU CAN (AND CANNOT) DO WITH RSAREF

The license at the end of this note gives legal terms and conditions.
Here's the layman's interpretation, for information only and with no
legal weight:

     1.   You can use RSAREF in personal, noncommercial applications,
          as long as you follow the interface described in the RSAREF
          documentation. You can't use RSAREF in any commercial
          (moneymaking) manner of any type, nor can you use it to
          provide services of any kind to any other party. For
          information on commercial licenses of RSAREF-compatible
          products, please contact RSA Data Security.

     2.   You can distribute programs that interface to RSAREF,
          but you can't distribute RSAREF itself. Everyone must
          obtain his or her own copy of RSAREF. (However, free
          licenses to redistribute RSAREF are available. For
          information, please send electronic mail to
          <rsaref-administrator@rsa.com>.)

     3.   You can modify RSAREF as required to port it to other
          operating systems and compilers, as long as you give a copy
          of the results to RSA Laboratories. You can't otherwise
          change RSAREF.

     4.   You can't send RSAREF outside the United States, or give it
          to anyone who is not a United States citizen and doesn't
          have a "green card." (These are U.S. State and Commerce
          Department requirements, because RSA and DES are
          export-controlled technologies.)

The restrictions on the distribution of RSAREF are the consequence of
export-control law. Similar constraints are placed on those
redistributing RSAREF under free license from RSA Laboratories.
Without the export-control law, RSAREF would be available by
anonymous FTP.


HOW TO GET IT

To obtain RSAREF, read the license at the end of the note and return
a copy of the "acknowledgement and acceptance" paragraph by
electronic mail to <rsaref-administrator@rsa.com>.

RSAREF is distributed by electronic mail in a UNIX(TM) "uuencoded"
TAR format. When you receive it, store the contents of the message in
a file, and run your operating system's "uudecode" and TAR programs.

For example, suppose you store the contents of your message in the
file 'contents'. You would run the commands:

     uudecode contents             # produces rsaref.tar
     tar xvf rsaref.tar

RSAREF includes about 60 files organized into the following
subdirectories:

     doc       documentation on RSAREF and RDEMO
     install   makefiles for various operating systems
     rdemo     RDEMO demonstration program
     source    RSAREF source code and include files
     test      test scripts for RDEMO


USERS' GROUP

RSA Laboratories maintains the electronic-mail users' group
<rsaref-users@rsa.com> for discussion of RSAREF applications, bug
fixes, etc. To join the user's group, send electronic mail to
<rsaref-users-request@rsa.com>.


REGISTRATION

RSAREF users who register with RSA Laboratories are entitled to free
RSAREF upgrades and bug fixes as soon as they become available and a
50% discount on selected RSA Data Security products. To register,
send your name, address, and telephone number to
<rsaref-registration@rsa.com>.


INNOVATION PRIZES

RSA Laboratories will award cash prizes for the best applications
built on RSAREF. If you'd like to submit an application, or want to
be on the review panel, please send electronic mail to
<rsaref-administrator@rsa.com>.


PUBLIC-KEY CERTIFICATION

RSA Data Security offers public-key certification services conforming
to forthcoming PEM standards. For more information, please send
electronic mail to <pem-info@rsa.com>.


OTHER QUESTIONS

If you have questions on RSAREF software, licenses, export
restrictions, or other RSA Laboratories offerings, send electronic
mail to <rsaref-administrator@rsa.com>.


AUTHORS

RSAREF was written by the staff of RSA Laboratories with assistance
from RSA Data Security's software engineers. The DES code is based on
an implementation that Justin Reyneri did at Stanford University. Jim
Hwang of Stanford wrote parts of the arithmetic code under contract
to RSA Laboratories.


ABOUT RSA LABORATORIES

RSA Laboratories is the research and development division of RSA Data
Security, Inc., the company founded by the inventors of the RSA
public-key cryptosystem. RSA Laboratories reviews, designs and
implements secure and efficient cryptosystems of all kinds. Its
clients include government agencies, telecommunications companies,
computer manufacturers, software developers, cable TV broadcasters,
interactive video manufacturers, and satellite broadcast companies,
among others.

RSA Laboratories draws upon the talents of the following people:

Len Adleman, distinguished associate - Ph.D., University of
  California, Berkeley; Henry Salvatori professor of computer
  science at University of Southern California; co-inventor of
  RSA public-key cryptosystem; co-founder of RSA Data Security, Inc.

Taher Elgamal, senior associate - Ph.D., Stanford University;
  director of engineering at RSA Data Security, Inc.; inventor of
  Elgamal public-key cryptosystem based on discrete logarithms

Martin Hellman, distinguished associate - Ph.D., Stanford University;
  professor of electrical engineering at Stanford University;
  co-inventor of public-key cryptography, exponential key exchange;
  IEEE fellow; IEEE Centennial Medal recipient

Burt Kaliski, chief scientist - Ph.D., MIT; former visiting assistant
  professor at Rochester Institute of Technology; author, Public-Key
  Cryptography Standards; general chair, CRYPTO '91

Cetin Koc, associate - Ph.D., University of California, Santa
  Barbara; assistant professor at University of Houston
 
Ron Rivest, distinguished associate - Ph.D., Stanford University;
  professor of computer science, MIT; co-inventor, RSA public-key
  cryptosystem; co-founder, RSA Data Security, Inc.; member, National
  Academy of Engineering; director, International Association for
  Cryptologic Research; program co-chair, ASIACRYPT '91

ADDRESSES

RSA Laboratories                   RSA Data Security, Inc.
10 Twin Dolphin Drive              100 Marine Parkway
Redwood City, CA  94065            Redwood City, CA  94065
USA                                USA

(415) 595-7703                     (415) 595-8782
(415) 595-4126 (fax)               (415) 595-1873 (fax)

PKCS, RSAREF and RSA Laboratories are trademarks of RSA Data
Security, Inc. All other company names and trademarks are not.

----------------------------------------------------------------------
                           RSA LABORATORIES
                      PROGRAM LICENSE AGREEMENT

RSA LABORATORIES, A DIVISION OF RSA DATA SECURITY, INC. ("RSA"), IS
WILLING TO LICENSE THE "RSAREF" PROGRAM FOR YOUR USE ONLY ON THE
TERMS AND CONDITIONS SET FORTH BELOW. YOUR ACKNOWLEDGEMENT AND
ACCEPTANCE OF THESE TERMS AND CONDITIONS BY RETURN ELECTRONIC
TRANSMISSION IS REQUIRED PRIOR TO DELIVERY TO YOU OF THE RSAREF
PROGRAM.

1.   LICENSE. RSA is willing to grant you a non-exclusive,
     non-transferable license for the "RSAREF" program (the
     "Program") and its associated documentation, subject to all of
     the following terms and conditions, but only:

     a.   to use the Program on any computer in your possession, but
          on no more than one computer at any time;

     b.   to make one copy of the Program for back-up purposes only;

     c.   to incorporate the Program into other computer programs only
          through interfaces described in the RSAREF Library
          Reference (the file "rsaref.txt" which accompanies the
          Program) (any such incorporated portion of the Program to
          continue to be subject to the terms and conditions of this
          license) both solely for your own personal or internal use
          or to create Application Programs; and

     d.   to modify the Program for the purpose of porting the Program
          to any other operating systems and compilers, but only on
          the conditions that: (i) you do not alter any Program
          interface, except with the prior written consent of RSA;
          and (ii) you provide RSA with a copy of the ported version
          of the Program by electronic mail.

     "Application Programs" are programs which interface with the
     Program but which do not incorporate all or any portion of the
     Program, whether in source code or object code form.

2. LIMITATIONS ON LICENSE.

     a.   RSA owns the Program and its associated documentation and
          all copyrights therein. YOU MAY NOT USE, COPY, MODIFY OR
          TRANSFER THE PROGRAM, IN EITHER SOURCE CODE OR OBJECT CODE
          FORM, ITS ASSOCIATED DOCUMENTATION, OR ANY COPY,
          MODIFICATION OR MERGED PORTION THEREOF, IN WHOLE OR IN
          PART, EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT OR
          WITH THE PRIOR WRITTEN CONSENT OF RSA. WITHOUT LIMITING THE
          GENERALITY OF THE FOREGOING, YOU MAY NOT PLACE THE PROGRAM
          ON ANY ELECTRONIC BULLETIN BOARD SYSTEM (BBS) OR MAKE THE
          PROGRAM AVAILABLE THROUGH ANY FILE TRANSFER PROTOCOL (FTP).
          YOU MUST REPRODUCE AND INCLUDE RSA'S COPYRIGHT NOTICES ON
          ANY COPY OR MODIFICATION, OR ANY PORTION THEREOF, OF THE
          PROGRAM AND ITS ASSOCIATED DOCUMENTATION.

     b.   The Program is to be used only in connection with a single
          computer. You may physically transfer the Program from one
          computer to another, provided that the Program is used in
          connection with only one computer at any given time. You
          may not transfer the program electronically from one
          computer to another over a network except in connection
          with your own personal or internal use of the Program. You
          may not distribute copies of the Program or its associated
          documentation. IF YOU TRANSFER POSSESSION OF ANY COPY,
          MODIFICATION OR MERGED PORTION OF THE PROGRAM, WHETHER IN
          SOURCE CODE OR OBJECT CODE FORM, OR ITS ASSOCIATED
          DOCUMENTATION TO ANOTHER PARTY, EXCEPT AS EXPRESSLY
          PROVIDED FOR IN THIS LICENSE, YOUR LICENSE SHALL BE
          AUTOMATICALLY TERMINATED.

     c.   The Program is to be used only for non-commercial purposes.
          You may not use the Program to provide services to others
          for which you are compensated in any manner. You may not
          license, distribute or otherwise transfer the Program or
          any part thereof in any form, whether you receive
          compensation or not.

     d.   You may not translate the Program into any other computer
          language.

     e.   You may not incorporate the Program into other programs
          through interfaces other than the interfaces described in
          the RSAREF Library Reference.

3.   NO WARRANTY OF PERFORMANCE. THE PROGRAM AND ITS ASSOCIATED
     DOCUMENTATION ARE LICENSED "AS IS" WITHOUT WARRANTY AS TO THEIR
     PERFORMANCE, MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR
     PURPOSE. THE ENTIRE RISK AS TO THE RESULTS AND PERFORMANCE OF
     THE PROGRAM IS ASSUMED BY YOU. SHOULD THE PROGRAM PROVE
     DEFECTIVE, YOU (AND NOT RSA OR ITS DISTRIBUTOR) ASSUME THE
     ENTIRE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

4.   LIMITATION OF LIABILITY. EXCEPT AS EXPRESSLY PROVIDED FOR IN
     SECTION 5 HEREINUNDER, NEITHER RSA NOR ANY OTHER PERSON WHO HAS
     BEEN INVOLVED IN THE CREATION, PRODUCTION, OR DELIVERY OF THE
     PROGRAM SHALL BE LIABLE TO YOU OR TO ANY OTHER PERSON FOR ANY
     DIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING BUT NOT
     LIMITED TO ANY DAMAGES FOR LOST DATA, RE-RUN TIME, INACCURATE
     INPUT, WORK DELAYS OR LOST PROFITS, RESULTING FROM THE USE OF
     THE PROGRAM OR ITS ASSOCIATED DOCUMENTATION, EVEN IF RSA HAS
     BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

5.   PATENT INFRINGEMENT INDEMNITY. RSA shall indemnify and hold you
     harmless from any and all liability, damages, costs or expenses
     (including reasonable attorneys' fees) which you may incur as
     the result of any claim that the unmodified Program infringes a
     United States patent in the field of cryptography. RSA shall
     have no obligation to you pursuant to this Section 5 unless: (i)
     you give RSA prompt written notice of the claim; (ii) RSA is
     given the right to control and direct the investigation,
     preparation, defense and settlement of the claim; and (iii) the
     claim is based on your use of the unmodified Program in
     accordance with this license. THIS SECTION 5 SETS FORTH RSA'S
     ENTIRE OBLIGATION AND YOUR EXCLUSIVE REMEDIES CONCERNING CLAIMS
     FOR PROPRIETARY RIGHTS INFRINGEMENT.

     NOTE: PORTIONS OF THE PROGRAM PRACTICE METHODS DESCRIBED IN AND
     ARE SUBJECT TO U.S. PATENTS #4,218,582 AND #4,405,829, ISSUED TO
     LELAND STANFORD JR. UNIVERSITY AND MASSACHUSETTS INSTITUTE OF
     TECHNOLOGY RESPECTIVELY. EXCLUSIVE LICENSING RIGHTS ARE HELD BY
     PUBLIC KEY PARTNERS OF SUNNYVALE, CALIFORNIA.

6.   RESTRICTIONS ON FOREIGN RESHIPMENT. THIS LICENSE IS EXPRESSLY
     MADE SUBJECT TO ANY LAWS, REGULATIONS, ORDERS, OR OTHER
     RESTRICTIONS ON THE EXPORT FROM THE UNITED STATES OF AMERICA OF
     THE PROGRAM OR OF ANY INFORMATION ABOUT THE PROGRAM WHICH MAY BE
     IMPOSED FROM TIME TO TIME BY THE GOVERNMENT OF THE UNITED STATES
     OF AMERICA. YOU MAY NOT EXPORT OR REEXPORT, DIRECTLY OR
     INDIRECTLY, THE PROGRAM OR INFORMATION PERTAINING THERETO.

7.   TERM. The license granted hereunder is effective until
     terminated. You may terminate it at any time by destroying the
     Program and its associated documentation together with all
     copies, modifications and merged portions thereof in any form.
     It will also terminate upon the conditions set forth elsewhere
     in this Agreement or if you fail to comply with any term or
     condition of this Agreement. You agree upon such termination to
     destroy the Program and its associated documentation, together
     with all copies, modifications and merged portions thereof in
     any form.

8.   GENERAL

     a.   You may not sublicense the Program or its associated
          documentation or assign or transfer this license. Any
          attempt to sublicense, assign or transfer any of the
          rights, duties or obligations hereunder shall be void.

     b.   This agreement shall be governed by the laws of the State of
          California.

     c.   Address all correspondence regarding this license to RSA's
          electronic mail address <rsaref-administrator@rsa.com>, or
          to

               RSA Laboratories
               ATTN: RSAREF Administrator
               10 Twin Dolphin Drive
               Redwood City, CA  94065
               USA

     d.   TO RECEIVE THE PROGRAM AND ITS ASSOCIATED DOCUMENTATION BY
          ELECTRONIC TRANSMISSION, YOU MUST TRANSMIT THE FOLLOWING
          ACCEPTANCE AND ACKNOWLEDGMENT TO RSA'S ELECTRONIC MAIL
          ADDRESS <rsaref-administrator@rsa.com>:

ACKNOWLEDGMENT AND ACCEPTANCE

I acknowledge that I have read the RSAREF Program License Agreement
and understand and agree to be bound by its terms and conditions,
including without limitation its restrictions on foreign reshipment
of the Program and information related to the Program. The electronic
mail address to which I am requesting that the program be transmitted
is located in the United States of America and I am a United States
citizen or a permanent resident of the United States. The RSAREF
License Agreement is the complete and exclusive agreement between RSA
Laboratories and me relating to the Program, and supersedes any
proposal or prior agreement, oral or written, and any other
communications between RSA Laboratories and me relating to the
Program.

-- 
+--------------------------------------------------------------------------+
|  Michael Sierchio                          1563 Solano Avenue, Suite 123 |
|  kudzu@netcom.com                                Berkeley, CA 94707-2116 |
+--------------------------------------------------------------------------+

Michael Sierchio posts the RSA Readme file dated March, 1992.
It's worth mentioning that the license that comes with RSAREF
currently is dated December and supersedes all previous
licenses, statements, etc. By agreeing to the license and getting
RSAREF/RIPEM, you agree to that supersession.

The README file of the license is freely available for ftp from
rsa.com.

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

In article <1993Jan8.015245.3200@netcom.com>, kudzu@netcom (Michael Sierchio) writes:
>In article <1993Jan6.224021.986@nntp.hut.fi> 
>	jkp@cs.HUT.FI (Jyrki Kuoppala) writes:
>
>>Could someone please post the copyright notices of the RIPEM and
>>RSAREF packages (or possibly just the code) here?
>
>How about the RSAREF README file, with all the restrictions, notices, 
>license agreement, etc. (see below)

It doesn't mention much about the copyright status and distribution
terms of RSAREF, just claims that "RSA" owns "the Program" and the
copyrights thereof.  The license agreement does seem to have some
language that if you sign it you contract to not distribute RSAREF and
a dozen of other things, but I'm talking about a situation with no
such contract made.

>Is it true that there's no Suomi word for toilet paper?

vessapaperi (or WC-paperi in "book language")

//Jyrki