3
$\begingroup$

I've just read a paper from 2004 which stated that the RC4 encryption algorithm was restricted to a 40 bit key size when exported from the USA; however the reference for this information (Applied Cryptography - Schneieir) was published in 1996.

Here's the link to the paper "The effectiveness of brute force attacks on RC4".

I'm relatively new to cryptography but as far as I'm aware, a lot of the old export laws have been relaxed. Was the key length of RC4 still restricted in 2004? If so, is that still the case?

Thanks for any help.

Improve this question
$\endgroup$
  • 3
    $\begingroup$ Beware of import restrictions of other countries though. Especially when importing your ePassport into such countries ;) $\endgroup$ – Maarten Bodewes♦ Oct 9 '14 at 12:29
  • 1
    $\begingroup$ There is still some export regulation, but it boils down to "fill out a certain form" to register your strong crypto export. $\endgroup$ – CodesInChaos Oct 9 '14 at 13:21
  • $\begingroup$ @CodesInChaos: unless you're exporting to North Korea, Syria, or an handful of other countries. If you want to export to those countries, it's a lot more than "fill out some paperwork" $\endgroup$ – poncho Oct 9 '14 at 14:37
  • $\begingroup$ Given that RC4 is a horrible cipher, with worrisome public cryptanalysis and plausible rumors that NSA can break it, they would likely be quite happy for you to use it, regardless of key size. $\endgroup$ – Matt Nordhoff Oct 9 '14 at 14:39
5
$\begingroup$

Afaik, the general export restrictions on keylengths of common ciphers were lifted during the Clinton administration. Here's the relevant wiki article.

Improve this answer
$\endgroup$
1
$\begingroup$

The regulation lifting the restrictions was published in Jan 2000. You can see this in the Federal Register, and I think the exact date was January 14, 2000. You can see this in for example http://web.archive.org/web/20000815053812/http://www.bxa.doc.gov/Encryption/pdfs/Crypto.pdf

Improve this answer
$\endgroup$
  • $\begingroup$ Thank you for your contribution. However, without any source reference this answer is incomplete at the very minimum. Answers should generally not consist of a single unverifiable statement without any reasoning to back it up. Could you update it? Otherwise the answer may be deleted for the stated reasons. $\endgroup$ – Maarten Bodewes♦ Jul 1 '19 at 12:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.