Elsewhere someone stated that he couldn't publish his crypto software on the Internet, because US Export Regulations require approval, if the key size is greater than 56 bits. I know that several decades ago there were such extremely rigorous restrictions. Could anyone kindly check whether that indeed remains so even today?
$\begingroup$
$\endgroup$
4
asked Mar 17, 2013 at 20:42
-
2$\begingroup$ These export regulations are (thankfully) obsolete, though cryptography is still considered a weapon and some restrictions still apply. See current regulations... this is a good read too. $\endgroup$– ThomasMar 17, 2013 at 21:33
-
1$\begingroup$ You often need to register your software, but as long as you don't export to a couple of blacklisted states, that's mostly a formality. For open source software the rules are even more relaxed. So effectively it's just a bit of bureaucracy thrown at you. $\endgroup$– CodesInChaosMar 18, 2013 at 8:25
-
$\begingroup$ But publishing on the Internet is export to the entire world, including the couple of blacklisted states, isn't it? $\endgroup$– Mok-Kong ShenMar 18, 2013 at 13:10
-
$\begingroup$ Yea, Mozilla got hit by this and this led to another change to the EAR to address this: federalregister.gov/articles/2011/01/07/2010-32803/… $\endgroup$– Yuhong BaoDec 8, 2014 at 9:32
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
8
First of all, this is not legal advice. However, I've been in the unfortunate position where I've had to deal with this legal nightmare. The new agreement which regulates export of cryptography internationally is called the Wassenaar Arrangement. If your product is what is called a mass market product, i.e available for purchase to the general public without restriction, you can ignore any export restrictions. You can also skip this if your software is open source and available for free for everyone. There's more exclusions such as if your only use is in DRM , if the input to the cryptographic algorithms can no be changed.
If you restrict your sales to a select subset of customers or if your product is exclusionary in some attribute, e.g price is too high to be considered mass market, you need to contact your local government body responsible for Wassenaar compliance.
The section you would be interested in is DUAL-USE LIST - CATEGORY 5 – PART 2 – "INFORMATION SECURITY".
If you feel you might fall under this arrangement it's best to follow the following rules:
- If your encryption is based on a symmetric algorithm, keep the key size at 56 bits or less. (e.g AES, DES, Blowfish...)
- If your encryption is based on the difficulty of factoring integers, keep the key size at 512 bits or less. (e.g RSA)
- If your encryption is based on the difficulty of computing discrete logarithms in a multiplicative group of a finite field, keep the size at 512 bits or less. (e.g Diffie Hellman over Z/pZ)
- If your encryption is based on discrete logarithms in a group other mentioned previously, keep the size at 112 bits or less. (e.g Diffie-Hellman over an eliptic curve)
If you do not follow these rules you will come under control of the government body responsible for Wassenaar compliance. Which is extremely likely to become a huge bureaucratic burden on your organization as export controls are extremely poorly set up to deal with things like software where you may have many thousands of customers. It is best to avoid it unless cryptography is an integral part of your product. Most companies and individuals are unaffected by the arrangement as it tries to be narrow enough to only capture the companies which trade with foreign governments.
If your system does any sort of cryptoanalytic work it's generally considered even more sensitive and your odds of being in export controlled territory increases.
-
$\begingroup$ That's very interesting. So basically you can give away a super-duper crypto program for free and everything's fine but if you decide to charge $10.000 for it then you must comply with Wassenaar? I thought the point of this agreement was to limit crypto access to countries hostile to the west (namely the US), not make a company limit its profits! $\endgroup$– rathMar 22, 2013 at 21:40
-
3$\begingroup$ "Controls do not apply to "technology" "in the public domain", to "basic scientific research" or to the minimum necessary information for patent applications. " $\endgroup$ Mar 23, 2013 at 13:37
-
2$\begingroup$ "In the public domain" - This means "technology" or "software" which has been made available without restrictions upon its further dissemination. $\endgroup$ Mar 23, 2013 at 13:38
-
4$\begingroup$ If you have semantic questions of that sort I strongly advice you to retain legal counsel. The Wassenaar arrangement is quite extensive and trying to interpret it without the proper knowledge is hazardous to say the least. I'm not a lawyer. $\endgroup$ Mar 23, 2013 at 18:05
-
1$\begingroup$ Right. I simply want to caution too optimistic interpretations of that document without serious and careful examinations. (An analogy: certain commercial contracts commonly contain in footnotes and in difficult to read tiny fonts some "non-trivial" passages.) $\endgroup$ Mar 23, 2013 at 20:40
$\begingroup$
$\endgroup$
3
The Wikipedia section referenced by @Thomas says:
Furthermore, encryption registration with the BIS is required for the export of "mass market encryption commodities, software and components with encryption exceeding 64 bits [...]
Furthermore the commerce control list published by BIS states the following (p. 1):
You must submit a classification request or encryption registration to BIS for mass market encryption commodities and software eligible for the Cryptography Note employing a key length greater than 64 bits for the symmetric algorithm (or, for commodities and software not implementing any symmetric algorithms, employing a key length greater than 768 bits for asymmetric algorithms or greater than 128 bits for elliptic curve algorithms) [...]
so the answer to your question is no. Still programmers and researchers publish papers and code online all the time without BIS permission.
-
$\begingroup$ Do I understand you correctly that "strictly" speaking an approval would be needed but "defacto" the authority tolerates the online publications? (I just want to be 100% sure of having correctly understood the issue.) $\endgroup$ Mar 18, 2013 at 8:17
-
1$\begingroup$ I'm neither an American nor a lawyer so I can't give a "definite" answer. I know there are some countries where you can't export crypto from the US (eg. N. Korea) but other than that it's my experience that code and academic publications are freely available online. I don't know if BIS goes after them or not but for example Schneier couldn't include source code in his book's international edition but has posted it online. He even tells the readers to go online for it. I hope this helps. You should email EFF, they'll know the answer for sure $\endgroup$– rathMar 18, 2013 at 16:53
-
$\begingroup$ Note however that the "encryption registration" is a pretty easy process. $\endgroup$ Dec 8, 2014 at 9:31
$\begingroup$
$\endgroup$
Taking the advice of @rath, I asked EFF with the question formulated in my comment to his post with the addition whether the US scientists doing online crypto publications could, at time points arbitrarily chosen by the authority, be accused of violation of the Export Regulations, or if it is juridically fully ensured that this could never happen. I have just obtained form EFF's Legal Intake Coordinator the following rather disappointing (though in some sense also rather interesting) answer:
Thank you for contacting the Electronic Frontier Foundation (EFF).
I'm sorry, but your question requires detailed legal analysis, and we're not able to provide individual legal advice. I recommend using the search interface, on the upper right-hand corner of every page in our website, to see what information you can find on our website. I feel confident that you'll find some helpful information.
Another resource you may find helpful is your local bar association: they usually provide low cost consultations at a very reasonable price.
answered Mar 20, 2013 at 7:29