encryption

Thread view:

Roedy Green - 19 Oct 2003 22:52 GMT

Do the US restrictions on good encryption refer only to electronic
communications, or do they also refer to how you encrypt your files
for your own use. Would they apply for example if someone visited the
country with their files encrypted on a lap top? Do they apply only
to electronic communication, or to CD's shipped my mail as well?

--
Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

VK - 19 Oct 2003 23:22 GMT

The law prosecute actions, not consequences.

Someone is going on electric chair because he killed a man, not because
that man died.

The same way export restrictions apply on inscription tools and
technology, and not consequences (encrypted data).

So if you decide to go to a Taliban-controlled area of Afganistan (I
would NOT suggest :-) , you are legally OK to take any encrypted data
you like.
But it's not OK to bring with you any software to decode this data or to
produce another encoded data.

> Do the US restrictions on good encryption refer only to electronic
> communications, or do they also refer to how you encrypt your files
[quoted text clipped - 6 lines]
> Coaching, problem solving, economical contract programming.
> See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

Roedy Green - 20 Oct 2003 03:06 GMT

>But it's not OK to bring with you any software to decode this data or to
>produce another encoded data.

But if a Canadian, e.g. me, creates the tool, is it illegal for an
American to carry that tool around the globe? It is legal to send
messages inside or in/out of the USA? Just what is illegal, the
exportation of supposedly unique American knowledge about encryption,
or using tools that would foil American government snoops?

What is the intent of the law?

--
Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

Michael Amling - 20 Oct 2003 04:33 GMT

> Do the US restrictions on good encryption refer only to electronic
> communications, or do they also refer to how you encrypt your files
> for your own use. Would they apply for example if someone visited the
> country with their files encrypted on a lap top? Do they apply only
> to electronic communication, or to CD's shipped my mail as well?

There's an exemption for software you take with you for personal use;
if nothing else, most laptops have a 128-bit SSL implementation in a
browser. The regulations apply to all exports, although they apply
different rules to different media. E.g. AFAIK, nothing in book form is
restricted.
You seem like the kind of person who could just wade through the regs
yourself, starting at http://www.bxa.doc.gov/Encryption/Default.htm. But
don't expect to get your answers in one sitting.
For a definitive answer, there are lawyers with expertise in this area.

--Mike Amling

Reply to this Message

Roedy Green - 20 Oct 2003 04:41 GMT

> You seem like the kind of person who could just wade through the regs
>yourself, starting at http://www.bxa.doc.gov/Encryption/Default.htm. But
>don't expect to get your answers in one sitting.
> For a definitive answer, there are lawyers with expertise in this area.

The question I am getting at is, would I get in trouble if I invented
a one-time pad XOR scheme for both sending secret messages and
encrypting personal files that used random FM noise to create the
keys. I am a Canadian and live in Canada. The people most likely
might use such a thing are Americans who travel a lot.

I am not trying to shave the law. I want to understand the spirit of
it.

--
Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

Michael Amling - 20 Oct 2003 14:17 GMT

>> You seem like the kind of person who could just wade through the regs
>>yourself, starting at http://www.bxa.doc.gov/Encryption/Default.htm. But
[quoted text clipped - 5 lines]
> encrypting personal files that used random FM noise to create the
> keys.

Well, OTP has its pitfalls. Cheap but effective cryptographic random
number generating hardware would also be nice for other uses.
Other than distinguishing hardware from software and key lengths
equivalent to >56 bits symmetric from key lengths <=56 bits, the regs
don't much care what the encryption technique is.

> I am a Canadian and live in Canada. The people most likely
> might use such a thing are Americans who travel a lot.

US export regulations don't apply to you if you're not exporting any
crypto from the USA. If your customers tell you credibly that it's for
their own use and not for reexport, you're as much off the hook as
distributors of 128-bit browsers are.

> I am not trying to shave the law. I want to understand the spirit of
> it.

We would all like to see a concise cogent version of the regulations,
a summary, a generalization, a spirit.

--Mike Amling

Reply to this Message

encryption

Free Magazines