- public-key cryptography was theorized in a 1970 note  by James Henry Ellis: The Possibility of Secure Non-Secret Digital Encryption;
- a feasible realization of that, similar to RSA, was described in a 1973 note  by Clifford Christopher Cocks: A note on Non-Secret Encryption;
- another feasible realization, similar to Diffie-Hellman key exchange, was described in a 1974 note  by Malcolm John Williamson: Non-Secret Encryption Using a Finite Field, and a 1976 note  (same author): Thoughts on cheaper Non Secret Encryption.
An account of these discoveries is given in a 1987 note  by J. H. Ellis: The History of Non-Secret Encryption; this is my rendering of an April 1998 ps archive, and is very similar to this document obtained from the NSA by FoIA case #19136 (narrative).
This calendar of event is confirmed by the December 1977 document  by J. H. Ellis: The Authentication Problem, obtained (with references redacted) in the same FoIA case, containing:
Non-Secret Encryption has now reached the phase where it is being considered for possible applications, and I find that many people are worried that the danger of spoofing may make its use untenable.
All versions of documents .. that I could locate (in 2014) are clearly re-typesettings (with the possible exception of the FoIA source for ). Ross Anderson hypothetized that there might have been alterations in the declassification process as an attempt to deny the existence of the then-secret GCHQ by re-attributing the documents to the CESG.
Also, I observe a discrepancy between an indication about  given in  by M. J. Williamson:
The information rate of the system is low in that 3 bits are broadcast for every 1 of the message. (The ratio in the method of  is 2 for 1).
and  as we read it, where there is nothing suggesting a significant expansion of plaintext to ciphertext; which in modern terminology is per textbook RSA, with public exponent equal to the modulus, and splitting of message in ECB mode:
The sender has a message, consisting of numbers $C_1$, $C_2$, $\dots$ $C_r$ with $0 < C_i < N$
He sends each, encoded as $D_i$ where $D_i = C_i^N$ reduced modulo $N$.
This opens a possibility that the author of  had access to material about  different from what we have (perhaps, more extensive than the remarkably terse version that we know). For example it could be that M. J. Williamson considered a single $C$, and the overhead related to $N$, as would be natural if $C$ was the key to another cryptosystem.
Are there public verbatim copies of any of the originals, or hope to obtain these?
Also: Is there an account of the circumstances of the early diffusion of any of these documents?