Messages in this thread | | | From | "Joshua E. Hill" <> | Subject | [Crypto] Re: ftp.kernel.org vs. ftp.funet.fi | Date | Fri, 18 Apr 1997 17:27:25 -0700 (PDT) |
| |
James Mastros said: > Libc is > not covered by ITAR, and I don't think it is covered by EAR, since it uses a > 64 bit key, which is legal for export.
hmmm... Granted, I don't know to what portion of libc you refer, but I can say that 64 bit symmetric key algorithms are _not_ exportable. The US government only recently said that 56 bit key algorithms could be exported, and that was only if the company agreed to develop and market "key recovery" (GAK) solutions which would have to be done within 2 years. The government issues a temporary export license, and reviews your progress toward the "key recovery" every few months. If they decide that you haven't made enough progress, they will _revoke_ your temporary license. At the end of the two year period, you _must_ stop selling your non-GAKed version internationally, and sell only the GAKed enhanced version. None of these regulations affect the legality of crypto _within_ the US, however.
If a company already has appropriate key recovery techniques installed, it can market any key size that they wish.
Purely from a crypto regulation standpoint, we were better off when Linus was in Finland. If we ever do get strong crypto in the kernel, Linus won't be able to manage the kernel anymore... (or he won't be able to export it, or he will be a felon). As this is the case, I doubt that real crypto will be in the official distribution of the kernel anytime in the near future.
Josh
-----------------------------Joshua E. Hill----------------------------- | "You can bring any calculator you like to the midterm, as long as it | | doesn't dim the lights when you turn it on." | | -- Hepler, Systems Design 182 | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------
| |