🚀 go-pugleaf

In article <1992Oct9.233126.10429@uoft02.utoledo.edu> jsteiner@anwsun.phya.utoledo.edu (jason 'Think!' steiner) writes:
>please correct me if i'm wrong, but in reading the FAQ my mind started
>to boggle & i need to clarify this:
>
>   1. RSA is pretty much a standard in Europe.
>   2. it is illegal to export RSA stuff from the US.
>
>now i've always thought the US government was a bit bass ackwards,
>but this is just silly.
	Yeah, incredible isn't it! It seems most americans don't care 
	how daffy (or evil!) their government is.  We've got an enormous 
	bureauracy devoted to fighting an "evil empire" which is now defunct, 
	we've got fundamentalist nut cases determining what goes into high 
	school biology texts and we have a War on Some Drugs that is quickly 
	eroding	what is left of the Bill of Rights.  We've also got a bunch of 
	cold war left overs in the NSA trying to protect us from the
	"evil empire" and in the process harming the US telecommunications
	industry.  It's a sad horrible joke but you get blank looks from 
	the man in the street when you mention it.  Perhaps now that the
	economy has hit the skids and we are on the edge of another great
	depression people will start to look at who our real enemies are
	and see that they aren't foreign after all. . . 



						smg

jsteiner@anwsun.phya.utoledo.edu (jason 'Think!' steiner) writes:
> please correct me if i'm wrong, but in reading the FAQ my mind started
> to boggle & i need to clarify this:
> 
>    1. RSA is pretty much a standard in Europe.
>    2. it is illegal to export RSA stuff from the US.

Absolutely correct, unless you get official permission for the export.

> now i've always thought the US government was a bit bass ackwards,
> but this is just silly.

Correct again.

It's the same with DES.  Mustn't export DES from the US.

Mantis uses DES in its software.  I have both the ANSI and military DES
specifications.

Silly, huh?

> jason "maybe i should move to the CIS..." steiner

If you do, you'll find that they already have DES and RSA.  I've chatted to
people in Russia who use PGP.  Basically, the US government's export controls
have been completely ineffective at stopping cryptographic technology from
leaving the US.

However, they do mean that no US company that might compete with Mantis can
use DES or RSA in products it ships to Europe.  Neat, huh?


mathew
-- 
You can communicate with me securely using PGP 2.0.  For more information
send mail to pgp@mantis.co.uk.

In article <1992Oct9.233126.10429@uoft02.utoledo.edu> jsteiner@anwsun.phya.utoledo.edu (jason 'Think!' steiner) writes:
>   1. RSA is pretty much a standard in Europe.
>   2. it is illegal to export RSA stuff from the US.

> this is just silly.

Isn't it.......

>am i reading this right? if it's true why is export of encryption
>schemes so much of a problem? apparently they're already out there.


The argument (only slightly rephrased by me from what I read) given by
Bobby Inman (ex-head of the NSA) was that:

1.	it's important to thwart crypto development in the private sector
as much as possible;

2.	all we have control over is the US and in particular US exports --
so that's what we're trying to control;

3.	the US is #1 in crypto research [they're working to make that not
true, of course, assuming it ever was] and #1 in computer manufacturing
[that's slipping, too -- never was true in crypto hardware, I believe
(excepting military contracts)];

4.	good crypto is like an atom bomb -- could make a major power of an
otherwise minor power -- needs to be suppressed -- mustn't be in the hands
of private citizens.


In other words (mine), the technology is out there but the US economy, if
it were allowed to produce good crypto in volume (eg., spurred on by
international markets), would flood the world with good crypto -- making it
likely that a lazy lawbreaker would be able to use good crypto and
therefore defeat eavesdropping.  The FBI is using roughly the same argument
for internal controls and demands for plaintext-tapping ports.


Nobody has argued against the idea that big time drug dealers can afford
good crypto equipment (eg., scrambler phones from Switzerland) -- but what
about the little folks -- high school students trying to buy a pound of pot
to sell to their friends?  Those are the real targets of this
administration -- along with people carrying large amounts of cash, of
course.  For all we know, the big time drug dealers are campaign
contributors....  :-(


What I want to know is how the candidates stand on this issue.  It's got a
small enough interest group that the debates will probably skip over it.
I'd expect Bush to keep up being DCI with all private citizens as the
potential enemy (who me?  paranoid?).  I'd worry a little about Perot --
given his habit of hiring private investigators.  I haven't heard from
Clinton anything to allow me to predict.

Does anyone else have a feel for this?

In article <1992Oct9.233126.10429@uoft02.utoledo.edu>, jsteiner@anwsun.phya.utoledo.edu (jason 'Think!' steiner) writes:
|> please correct me if i'm wrong, but in reading the FAQ my mind started
|> to boggle & i need to clarify this:
|> 
|>    1. RSA is pretty much a standard in Europe.
|>    2. it is illegal to export RSA stuff from the US.
|> 

This is not strictly correct.  It is illegal to export cryptographic stuff (including RSA) without first getting an export permit from the State Department. While this is a time-consuming process, it is by no means impossible to get such an export license.  It all depends on who the designated recipient is.

If you were to apply for an export license to sell RSA to Lloyds Bank in the UK, then it would probably be granted (after some months of bureaucracy).  If you wanted to sell it to the Iraqi government, you probably wouldn't get it approved!
(and if you wanted to sell it to BCCI a couple of years ago, you probably would have gotten the license approved, since they were a bank!  No one said the policy was logical.)

I'm not trying to defend the export restriction program, as it is a real pain for any company trying to sell security in the international marketplace.  Most of the rules also seem to be locking the barn door long after the horse was stolen.

However, it is possible to export cryptographic equipment from the US.   It is only illegal to do so without an export license, and it is possible to get those licenses approved for the right customers.

In article <Vo0isB15w165w@mantis.co.uk> mathew <mathew@mantis.co.uk> writes:
   jsteiner@anwsun.phya.utoledo.edu (jason 'Think!' steiner) writes:
   > please correct me if i'm wrong, but in reading the FAQ my mind started
   > to boggle & i need to clarify this:
   > 
   >    1. RSA is pretty much a standard in Europe.
   >    2. it is illegal to export RSA stuff from the US.

   Absolutely correct, unless you get official permission for the export.

The rules were recently loosened just a little so that "mass-market"
software packages using RSA's RC2 and RC4 algorithms can be exported
freely, and the review process streamlined for others. They didn't
budge on DES, though. Source: Software Publisher's Association,
Washington DC.
[...]
   However, they do mean that no US company that might compete with Mantis can
   use DES or RSA in products it ships to Europe.  Neat, huh?
You've been warned! Duck!

   mathew
   -- 
   You can communicate with me securely using PGP 2.0.  For more information
   send mail to pgp@mantis.co.uk.

Ditto. Send info to pressonc@ingr.com (I'm moving this week and my
subdomain will change).

-- Craig Presson
New opinions are always suspected, and usually opposed, without any other
reason but because they are not already common. 
                -- John Locke