Why there are limitations on using encryption with keys beyond certain length?

Question

I am writing a java program to encrypt a message using 256-bit AES encryption, but I am getting illegal key size error, I have read that I have to use some JCE Unlimited Strength Jurisdiction Policy Files to encrypt/decrypt message with key of 256-bit or longer, but I do not understand why there is a limit on using a key size? Why using 256-bit encryption is disabled in Java by default?

Is it a crime to encrypt/decrypt files using 256-bit keys?

Answer 1

There are many different cryptography laws in different nations. Some countries prohibit export of cryptography software and/or encryption algorithms or cryptoanalysis methods.

In some countries a license is required to use encryption software, and a few countries ban citizens from encrypting their internet communication. Some countries require decryption keys to be recoverable in case of a police investigation.

Issues regarding cryptography law fall into four categories:

• Export control, which is the restriction on export of cryptography methods within a country to other countries or commercial entities. There are international export control agreements, the main one being the Wassenaar Arrangement. The Wassenaar Arrangement was created after the dissolution of COCOM (Coordinating committee for Multilateral Export Controls), which in 1989 "decontrolled password and authentication-only cryptography."
• Import controls, which is the restriction on using certain types of cryptography within a country.
• Patent issues, which deal with the use of cryptography tools that are patented.
• Search and seizure issues, on whether and under what circumstances, a person can be compelled to decrypt data files or reveal an encryption key.

Restrictions on the import of cryptography

Countries may wish to restrict import of cryptography technologies for a number of reasons:

• Cryptography may increase levels of privacy within the country beyond what the government wishes.
• Citizens can anonymously communicate with each other, preventing any external party from monitoring them.
• Encrypted transactions may impede external entities to control the conducting of business.
• Imported cryptography may have backdoors or security holes, intentional or not, which allow foreigners to spy on persons using the imported cryptography; therefore the use of cryptography is restricted to that which the government thinks is safe, or which it develops itself.

The Electronic Privacy Information Center and Global Internet Liberty Campaign reports use a color code to indicate the level of restriction, with the following meanings:

• Green: No restriction
• Yellow: License required for importation
• Red: Total ban

Here is List of Countries, each with their level of import restrictions.

and List of Countries with their import/export restrictions details and explanation

Import Limits on Cryptographic Algorithms in Java

Due to import regulations in some countries, the Oracle implementation provides a default cryptographic jurisdiction policy file that limits the strength of cryptographic algorithms.

If stronger algorithms are needed (for example, AES with 256-bit keys), the JCE Unlimited Strength Jurisdiction Policy Files must be obtained and installed in the JDK/JRE.

It is the user's responsibility to verify that this action is permissible under local regulations.