HOME

GENERAL INFORMATION

• New to the NSRL?
• Project Overview
• Library Contents
• Contacts
• Subscription Information
• Redistribution Policy
• FAQs

TECHNICAL INFORMATION

• Technical Papers
• Presentations

DOWNLOADS

CFTT Website

Redistribution Policy for NIST NSRL RDS
Effective: October 2002

The redistribution policy for the National Institute of Standards and Technology (NIST) National Software Reference Library (NSRL) Reference Data Set (RDS), also known as NIST Special Database 28, is as follows

Redistribution is free and encouraged. The CD may be duplicated or images of the CD suitable for CD writers may be created and distributed, among other methods. The NSRL RDS was developed at NIST by employees of the Federal Government in the course of their official duties. Pursuant to title 17 Section 105 of the United States Code the RDS is not subject to copyright protection and is in the public domain.

Hash values of the distribution files that comprise the NSRL RDS are available on the website www.nsrl.nist.gov and the RDS is digitally signed. This provides traceability for the RDS file signatures, since it is possible to verify that that no changes have been made to its contents. Sample procedures for verifying the RDS follow.

NIST would appreciate acknowledgement if the RDS is used.

If modifications are made to the RDS, the resulting product must clearly state that it is not the official version of the RDS.

When you receive or create an NSRL RDS CD you are encouraged to verify the contents against the hash values on www.nsrl.nist.gov . Consumers receiving a NSRL RDS CD outside of the subscription distribution path have the responsibility to verify the contents. One benefit of the $90 per year subscription is physical traceability of the CD to NIST.

One example of verifying the NSRL RDS 1.3:

If you acquire a file called "nsrl_1_3.iso" and it has 544,297,488 bytes and the SHA-1 hash value E81E44BAECAB2D2C41D249D84F92F495732B516A then it is extremely likely to be the ISO Standard 9660 format image we used to create the RDS 1.3 CD.

If you burn that image to a CD, you should have four distribution files. The hashes of those files can be found on the NSRL website, including the hashes for the file RDS.zip that has 473,887,509 bytes and the SHA-1 value of 8D663F479A5A441470BD63A57BDB5687BF4D52CB.

Expanding the RDS.zip file provides the four files of the RDS hashset, which have the following names, bytes and SHA-1 values

NSRLFile.txt  1,319,349,454  07D07CAB6FB90752B7DD0CAA5FC076877DD051B1
NSRLMfg.txt           9,244  71B5EADCD8C3FFD7276461900642D535FEF4283E
NSRLOS.txt            3,606  06D45CC6F238DBD6E7C178CD2F85FABE9CF7B2E7
NSRLProd.txt        118,612  AE4FB12E5E6DF1E8D0EAEDF1B91420E086B8CD0C
    

We supply additional hash values for the distributed files on the NSRL website.