From: butzerd@blanc.eng.ohio-state.edu (Dane C. Butzer)
Subject: Legalities re: new encryption program
Organization: The Ohio State University Dept of Electrical Engineering
Distribution: usa
Date: Tue, 1 Sep 1992 02:54:15 GMT

First of all, even though I'm sending this posting through OSU (where I'm a
graduate student), I'm making it in my capacity as a partner in an independent
company - we don't have internet access yet...

This posting is a request for some information from the security world out
there.  Basically, we'd like to find out what legal requirements/hurdles exist
for the sale of a new data encryption algorithm.

More specifically, we've developed a data encryption program based on a new
type of random number generation.  This generator produces a stream of numbers
with the following basic properties:
     1) The cycle of repetition is at least 10^34 (ten to the thirty-fourth).
     2) The correlations between any sections of the numbers is statistically
	zero (with a very high level of confidence).
     3)	2^128 (two to the one hundred twenty eighth) different number streams
	can be generated (ie. there are 2^128 different keys).
     4)	Changing the key be even one bit is guaranteed to change over 99% of
	the numbers.
     5) The cross correlations between each different number stream is almost
	zero. (With a normalized correlation of 1 being complete correlation,
	and a sample size of 8000 numbers, the typical correlation values are
	around 0.01; sometimes they are as high as 0.05, and sometimes they
	are as low as 0.00001).

The applications for such a generator in encryption are obvious.  Now, we're
curious about the legal side of selling something like this.  Are there
special certification, registrations, etc. that have to be taken care of?  Can
such a program even be distributed/sold legally?  Will we get squashed by the
government (Agents burst into the apartment and take everything at bazooka
point ;-> )?

Also, we're thinking about distributing a free copy of a limited version of
the program for the internet world to try out.  This version would only be
able to encrypt files of size 10k or less, would be time-bombed (ie. die off
after a certain date), and would probably not incorporate the most efficient
implementation of the generator (ie. it would be slow).  We're also thinking
about releasing an encrypted message and most of the corresponding clear text,
with a fee of $500 offered to whoever can "break" the encryption first (This
is just an idea right now - the rules to such an experiment would have to be
spelled out in detail - not something to bore you with now.)  Any comments on
the legality/risks involved with doing this?

Please respond here or send e-mail to butzerd@eng.ohio-state.edu.

Thanks, and if this is the wrong place to have posted this, or if this message
seems too commercial, sorry - I'm new at posting to the internet :-) Also, I
had no clue as to where else to go to get this information.


/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
| This posting is of a purely personal nature.  It is not a posting as |
| student, or a graduate, of OSU.  The views and opinions expressed    |
| are mine.  OSU has no control over them.                 Dane Butzer |
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/


Newsgroups: alt.security