RSA Data Security Formula Leaked, Raising Questions About Data Encryption Security

The underlying software formula of the popular coding system used for protecting information sent over computer networks has been anonymously circulated, compromising the long-term effectiveness of the system. The formula, known as RC4, belongs to RSA Data Security Inc., a small software company that sells encryption software to major tech firms. Although the disclosure does not necessarily allow eavesdroppers to intercept and unscramble coded messages, it throws into question a two-year-old agreement between the government and computer and software companies regarding the export of products incorporating the RSA system.

Key Takeaways:

• The RC4 formula, a trade secret of RSA Data Security Inc., has been anonymously posted on electronic bulletin boards worldwide, potentially compromising the effectiveness of the encryption system.
• The disclosure raises questions about a two-year-old agreement between the government and computer and software companies allowing the export of products incorporating the RSA system.
• RSA Data Security executives consider the misappropriation of the formula a serious violation of the law and a gross abuse of the Internet.
• The company holds several patents for public key cryptography, a technology that permits individuals to send and receive secret messages.
• Members of the Cypherpunks group, who oppose the government's controls on data encryption technology, have expressed plans to create their own version of the RC4 formula, free from RSA Data Security's control.
• RSA Data Security officials are conducting an investigation and considering legal action against those responsible for the disclosure.

Statistics:

• Revenues of RSA Data Security Inc.: $5 million to $10 million a year.
• Number of foreign-made software products using the Data Encryption Standard (D.E.S.): at least 166.
• Year the D.E.S. was invented: 1970s.
• Year the agreement between the Software Publishers Association and the N.S.A. was reached: Two years ago.

Sources:

• "RSA Software Formula Circulated on Electronic Bulletin Boards," Unattributed article, exact source not specified.
• Interview with Jim Bidzos, president of RSA Data Security, exact source not specified.
• Interview with Douglas Miller, manager of governmental affairs at the Software Publishers Association, exact source not specified.