Strong Crypto Code Published Online for Authentication Press Backgrounder San Francisco, December 23, 1997 The software is being published today as part of Mr. Gilmore's effort to establish authenticity checking in the Internet Domain Name System. The naming system is vulnerable to tampering, as was shown in July when Eugene Kashpureff redirected accesses to Network Solutions' web page. The Internet Engineering Task Force has defined a protocol to add cryptographic checking, and several companies and organizations are changing the software to match it. Trusted Information Systems and Mr. Hugh Daniel have submitted formal applications to the Government, asking whether they needed permission to export this authentication software. All of the responses indicated that no permission was needed. Since the plain text of the regulations, and the plain responses of the Government, agree with his understanding, Mr. Gilmore determined that the rumors emanating from the National Security Agency were just that, rumors, without the force of law. The source code Mr. Gilmore is publishing today is a very early prototype of the Domain Name System Security software. This particular version of the software is more than a year old, cannot be used commercially, and has numerous problems; it is only recommended for serious experimenters. But it is the exact version of the software which the US Government formally stated did not need export permission. Mr. Gilmore and the Internet Software Consortium plan to publish much more modern and usable Secure Domain Name software early in 1998. These future versions will include the DNSsafe cryptography library, which permits commercial use, and significantly improves on the RSAREF software used in the prototype. John Gilmore is an entrepreneur and civil libertarian. He was an early employee of Sun Microsystems, and co-founded Cygnus Solutions, the Electronic Frontier Foundation, the Cypherpunks, and the Internet's "alt" newsgroups. He serves on the Board of Trustees of the Internet Society. He has twenty-five years of experience in the computer industry, including programming, hardware and software design, and management. He is a significant contributor to the worldwide free software development effort. His advocacy efforts on encryption policy aim to improve public understanding of this fundamental technology for privacy and accountability in open societies. The Electronic Frontier Foundation, which Mr. Gilmore co-founded, is sponsoring a lawsuit to have the entire cryptography export control regime overturned. In the three-year suit, Bernstein v. State, Judge Marilyn Hall Patel invalidated both the State Department and Commerce Department export controls. She ruled they are an unconstitutional prior restraint against our First Amendment right to speak and publish about cryptography. The case is now in the Ninth Circuit Court of Appeals. Domain Name System Security: http://www.toad.com/dnssec/ or http://www.flash.net/~dnssec/ Internet Software Consortium: http://www.isc.org RSA Data Security: http://www.rsa.com Electronic Frontier Foundation: http://www.eff.org Press Contacts: John Gilmore, Founding Board Member, EFF +1 415 221 6524, gnu@toad.com Shari Steele, Staff Attorney, Electronic Frontier Foundation +1 301 375 8856, ssteele@eff.org