🚀 go-pugleaf

Paul A. Karger <karger@osf.org> writes:

> A number of European countries require some form of
> key registration before cryptography can be used in
> telecommunications.  I believe that both France and
> Germany have laws of this kind.

I have seen this claim made several times in sci.crypt and decided to
check what is the law in my country (France). The law is indeed a real
threat to privacy, but my understanding is that it does not require
you to register your secret key.

The "decret du 18 avril 1939" defines 8 categories of arms and munitions
from most dangerous (1st category) to least dangerous (8th).

The "decret 73-364 du 12 mars 1973" specifies that cryptography
equipment belongs to the second category. Any usage of such equipment
requires authorization from the Prime minister. The authorization
cannot be given to people who have committed a crime, or to alcoholic
people. (If you want to encrypt your email, don't drink :-)

The "decret 86-250 du 18 fev 1986" extends the definition of
cryptography equipment to include software. It specifies that each
request for authorizing professional *OR PRIVATE* usage of the
equipment must be sent to the minister of the PTT (telecommunications).
The request must include a complete and detailed description of the
"cryptologic process", and if this is materially possible, of two
copies of the envisaged equipment. My understanding is that
"cryptologic process" only means the encryption algorithm, but not the
secret key.

The "loi 90-1170 du 29 decembre 1990" states that export *OR USE*
of encryption means must be
- previously declared when used only for authentication
- previously authorized by the Prime minister in all other cases
The fines go up to 500 000F (about $100,000) and three months
in jail.

The French law is much more restrictive than in the US, since I think
it legal (up to now!) in the US to use encryption without prior
authorization from the government. However the French law does not
seem to be enforced at all.  Almost nobody in France is aware of this
law. US citizens seem to be much more aware of the law in their
country regarding encryption.

Jean-loup Gailly
jloup@chorus.fr