NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/sci/crypt/5988

Text File | 1992-12-21 | 2.6 KB | 60 lines

Newsgroups: sci.crypt
Path: sparky!uunet!rosevax!texan!bill
From: [e-mail] (William Hawkins)
Subject: Re:  Exporting password protection
Message-ID: <[e-mail]>
Sender: [e-mail] (USENET News administrator)
Nntp-Posting-Host: texan
Organization: Rosemount, Inc.
Distribution: usa
Date: Mon, 21 Dec 1992 06:55:50 GMT
Lines: 47


Thanks to you who have replied to my query on exporting password
protection.  You are correct that it is a matter for Commerce,
and not State, but that is the problem.

In July of '92, the Department of State, Bureau of Politico-
Military Affairs, issued an amendment to the International
Traffic in Arms Regulations Munitions List.  Basically, it says
that a company wishing to export a mass market software product
containing encryption may apply to DOS (State) for a transfer
of jurisdiction to the Department of Commerce (DOC) IF the
software is mass market (over the counter with no special
training or support  (process control systems require lots of
training and support, but not for encryption)) AND the data
encryption algorithm is RC4 and/or RC2 with a key space of 40
bits.  It is noted that RC4 and RC2 are proprietary to RSA
Data Security, Inc.  It must not be possible for both RC4 and
RC2 to operate on the same data.

If you can meet those criteria, you can be transferred to DOC
in one to two weeks.  The problem is that Commerce seems to
think that anything that hides data requires an export license.
Reading the words, it looks like rot13 would be prohibited
without a license.  Nor does it count that your non mass media
software uses the *same* encryption algorithm as mass media
software.

One kind of DOC license requires the recipient of the software
to swear that the software will not be exported to anyone on
the restricted list.  You can imagine how much trouble it must
be to keep up with the list.  Think about it.  The list is made
for geographical boundaries.  When is the last time that a piece
of geography threatened you?  Iran is on the forbidden list.  Are
there any citizens of Iran outside the geographical borders of
that country?  Do they have access to encryption techniques?  I
do not mean to pick on Iran, but only to show that the borders
have nothing to do with access to information.

We will, of course, comply with the law of the land, as interpreted
by the nearest bureaucrat.  By way of disclaimer, it is not my job
to find out what the bureaucracy requires; I only sit on the
sidelines and watch it all go by.

Today is the 21'st.  News arrives from the 15'th, so I still
invite email replies.

[e-mail]  Minneapolis, MN  [phone]