Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Encryption Security United States

Current State of Exporting Open-Source Encryption? 22

Posted by Cliff from the is-it-safe-to-host-code-in-the-US dept.
Jay Maynard asks: "The project team is getting ready to release a new version of the Hercules IBM mainframe emulator. Part of the update is support for new instructions IBM added in their latest z/990 system, and two of those do encryption. The Bureau of Industry and Security (formerly the Bureau of Export Administration) changed their regulations on June 6, 2002 to grant a license to export open-source encryption code to anyone but the usual suspects (denied persons and banned countries). They went on to recently clarify that putting up code for download did not in itself constitute exporting to those banned countries or persons. There are many open-source projects that still host encryption code outside the US because of past rules. Is there still a reason for doing so?"
This discussion has been archived. No new comments can be posted.

Current State of Exporting Open-Source Encryption? More

Current State of Exporting Open-Source Encryption?

Comments Filter:

  • No. (Score:4, Informative)

    by molo ( 94384 ) on Tuesday July 08, 2003 @06:53PM (#6396218) Journal
    No. Next question?

    Seriously, you just answered your own question. This doesn't mean that Debian can get rid of its non-US archive. It still contains things that are patented in the US or illegal due to the DMCA.

    -molo

  • Yes, very much! (Score:5, Insightful)

    by shfted! ( 600189 ) on Tuesday July 08, 2003 @07:04PM (#6396283) Journal
    There are many open-source projects that still host encryption code outside the US because of past rules. Is there still a reason for doing so?" DeCSS is the obvious example. Without code based on it, I could not watch DVDs I rent on Linux. As DeCSS is made illegal by the DMCA, the only choice for projects using that code is to host outside the US.

  • It is hopeless. (Score:1, Insightful)

    by Mensa Babe ( 675349 )
    The current state of exporting free software encryption is so "wonderful" that I have to manually type each and every sample program from Schneier's Applied Cryptography book listings to try it out, because a disc with exactly the very same software would be illegal and, by ex tention, evil. We all know that terrorists cannot type, so thank god we are entirely safe that way. I just love it. I feel like in the days, when I was typing C64 games in BASIC from '80s' computer magazines. *sigh*

  • off the top? (Score:5, Insightful)

    by mikecarrmikecarr ( 43676 ) <mcarr-ref-slashdot@pachogrande.com> on Tuesday July 08, 2003 @07:14PM (#6396344) Homepage Journal

    "There are many open-source projects that still host encryption code outside the US because of past rules. Is there still a reason for doing so?"

    uhm... why should anyone outside the US believe that the US will continue with its current position? Does the current political climate of the US, as observed by other nations (i.e. Canada), suggest that open-source encryption (read: tools to aid and abet terrorists) will continue to enjoy the lack of restrictions?

    i dunno, it seems like a whole shwack of 'once bitten, twice shy' to me.

    not trying to flame, i just can't see anything (from this side of the border) to suggest that we should be trusting the US not to change their position. *shrugs*

  • one good reason to continue (Score:3, Interesting)

    by nurb432 ( 527695 ) on Tuesday July 08, 2003 @08:37PM (#6396788) Homepage Journal
    The rules will change again.. trapping the code inside the borders.

    its just a matter of time.
    • The rules will change again.. trapping the code inside the borders.

      It's even worse than that. The change is an administrative change, not a change to the law. (IANAL, but I have worked under ITAR exemptions in the past and so have made myself familiar with the implications.) Should the administrative change be reversed at some time, and you have exported encryption technology, you have suddenly become guilty of a crime.

      Because the law didn't change, it's not a case of ex post facto. It's uncertain w

  • Everyone possess the know how. I mean, if you can remotely attempt to build an atomic bomb or an ICBM you possess the know-how to encrypt/decrypt data. Plus, there are a lot of papers out there that give you all the info you need to write your own algorithm. Hardware encryption I can understand, but software? Come on, get real. Foreigners are not stupid.
    • if you can remotely attempt to build an atomic bomb or an ICBM you possess the know-how to encrypt/decrypt data.

      Hrmm, ehh, well. If you only worry about the peple capable of building nukes, than your point is valid. But there are plenty of others to worry about, people that could do damage, even if they don't have the resources available to create nukes.

      The US, and other large governments, probably all have a few tricks up their sleeve that they don't want to tell the world. Problem is, these are alread

  • Of course. BSD. (Score:4, Insightful)

    by mirabilos ( 219607 ) on Wednesday July 09, 2003 @04:40AM (#6398781) Homepage
    The BSD spirit means we want to make stuff available
    to anyone, free to use. This does include Microsoft,
    Irak, Afghanistan and others.

    Please don't feel offended - this is just the way
    the BSD spirit works, and it's intended.

    From an European's viewpoint, the US is one of the
    most unfree countries around the world.

    • Re:Of course. BSD. (Score:3, Insightful)

      by necrognome ( 236545 ) *
      From an European's viewpoint, the US is one of the most unfree countries around the world.

      Similar things could be said about Europe, you know (and this is from a leftist), given the following European phenomena:
      1. Oppressive gun control laws.
      2. Useless anti-hate speech laws
      3. Identity cards and a love of surveillance

      Anytime you cross the Atlantic (in either direction), it seems you trade in some freedoms in exchange for others.
  • If you are concerned about the export laws, there are two factors to consider:

    1) It's unlikely that these two new instructions would even count as encryption technology. Unfortunately Google couldn't find me anything about the z/990 extensions, but I rather suspect that if it's just those two codes, they're going to be so low-level as to be almost meaningless. The NSA and etc mostly cares about preventing people from getting their hands on useable applications, rather than the base algorithms - seems they
    • I was mistaken: it's five new instructions. They provide DES and 3DES symmetric cryptography, and SHA-1 message digest functions. The PDF introduction to the z/990 I found at IBM's Redbooks site [ibm.com] doesnt' go into a lot of detail, but it does say that much in chapter 5. The biggest omission, and one that may prove critical, is the key lengths supported (the BIS site is unclear as to whether crypto with keys longer than 56 bits falls under the open source exemption).

      We may find ourselves holding off for now, m
      • I was mistaken: it's five new instructions. They provide DES and 3DES symmetric cryptography, and SHA-1 message digest functions.

        Wow, screwy. I've never heard of any chip that did something like this on an instruction level. I don't know about the key length limitations, but I can tell you that I have distributed 168-bit 3DES for years as part of a crypto library and never heard a peep from anyone related to the export laws (many other people continue to host well-known crypto projects out of the US, as w
        • I've never heard of any chip that did something like this on an instruction level.

          That's why it's a mainframe. :-)

          The crypto coprocessors are beyond the scope of Hercules, at least as it stands now (although I wouldn't rule out adding it in the future). Even so, however, I get from my reading of 740.13 that the key length doesn't matter. (Am I wrong there?) I doubt that part will become an issue anytime soon, but the five instructions are rather more of an immediate problem. It looks like the message dig
  • The current set of rules are just rules. The government agency (whatever it's called) can change those rules any time it wants. The NSA (or whoever) cleverly ensured that the Bernstein case didn't set a precedent, so a crypto project basically has no legal protection whatsoever.
    -russ

Slashdot Top Deals

"A car is just a big purse on wheels." -- Johanna Reynolds

Close