🚀 go-pugleaf

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
> The above statement, is a complete mess. First, according to ITAR, 
> exporting of ANY encryption software might be illegal, not just of DES. 

Correct, by my understanding.

> (I just wonder how all those crypt(3) functions in the Unixes around 
> were exported...)

They weren't.  Export versions of UNIX have the crypt(3) functions removed
from the C libraries.  The login program (which uses crypt(3) internally to 
authenticate passwords) turns out to be OK, because it cannot be used to 
encrypt or decrypt information.  I have seen it reported in print that there 
is an exemption from ITAR for software which performs authentication only 
(and cannot be used for encipherment), but I have not located the specific 
regulation in question.

> Fortunately, the USA is not the only country that has programmers, so 
> there are plenty of free DES implementations around. I really cannot 
> understand why RIPEM is not available for anonymous ftp, without the DES 
> and the RSAREF stuff. Anybody should be able to plug in additional 
> DES- and RSAREF-compatible modules... 

This possibility is being explored.  Making it available without DES included 
is not a problem.  Making it available without RSAREF, but still assuming the 
*use* of RSA in its operation, may not be enough to satisfy RSA's lawyers.  
However, we shall see how this develops.  I hope that something along these 
lines can be worked out.



Amanda Walker
InterCon Systems Corporation