PREMIUM SEARCH Search by job title, geography and build a list of executive contacts
It's unlikely the examiner who granted a patent for "Cryptographic communications system and method" ever thought he was enabling a commerce revolution. But as the patent on the encryption system that RSA Data Security Inc. secured 17 years ago reaches the end of its life on Sept. 20, it has provided a cornerstone for electronic commerce and become part of every Web browser and Internet-enabled wireless phone, as well as millions of other programs and devices.
In 1977, Ronald L. Rivest, Adi Shamir, and Leonard M. Adleman were young researchers at the Massachusetts Institute of Technology. A year earlier, computer scientists Whitfield Diffie and Martin Hellman had published research that proposed an almost magical solution to an ancient problem: Diffie and Hellman found a new way to widely distribute the keys needed to decrypt secret communications. Instead of dispatching couriers with briefcases locked to their wrists, the keys could be distributed safely over open communication channels, like the then-new Internet.
Rivest, who is still at MIT, Shamir, now of the Weitzmann Institute in Israel, and Adleman, of the University of Southern California, took the academic research and came up with a simple, mathematically elegant method, or algorithm, that made practical what became known as "public key cryptography." MIT owned the patent rights, but the three researchers set up RSA as a company to administer licenses and collect royalties.
TOO SLOW. It took a decade for the technology to become a commercial heavyweight. In the mid-1990s, Netscape Communications (AOL) developed a method for safe online transactions called the "secure socket layer" (SSL), which was based on RSA encryption. SSL keeps both credit-card numbers and other personal information secret and also can ensure that the Web site on the other end of the transaction is legitimate -- although the second half has never been implemented well. Even so, SSL quickly became a standard feature of all browsers -- and e-commerce took off.
Interestingly, RSA is hardly ever used to encrypt data. Although mathematically simple, it is far too slow to be used for all but tiny bits of information. So in normal practice, RSA is used only to send an encrypted key used to scramble and unscramble data with a much faster method, such as the so-called Data Encryption Standard. But RSA is fast enough to allow keys to be changed with every transaction, greatly enhancing security.
The patent's expiration is of more historical significance than practical importance. RSA Security Inc. (RSAS), as the company is now known, gets nearly all its revenues from sales and licensing of security products, not from the RSA algorithm itself. "The royalties we get are no longer based on the patent. It has no material impact," says Scott Schell, RSA Security's senior marketing vice-president.
HOMEGROWN VERSIONS. RSA now has competition for what is known as cryptographic key exchange. A method called elliptic curve encryption, sold by Certicom Inc. (CERT) is particularly attractive for handheld devices because it requires less mathematical computation. But at the same time, an end to most U.S. export restrictions has freed RSA Security to compete in foreign markets, where the algorithm was never patented and homegrown versions sprang up.
Seventeen years ago, public-key encryption was virtually unheard of, and even software patents were a novelty. That both are now commonplace is testimony to the impact of Rivest, Adleman, and Shamir's algorithm on commerce.
Copyright 2000, Bloomberg L.P.
Printer-Friendly Version
