Chapter 4 – Troubleshooting
Multi-Tech RouteFinder RF650VPN User Guide
165
Q19. What are the current Certificate export laws?
A19. New US encryption export regulations took effect on January 14th, 2000. At the time of this
publication, CAs may export certificates to any non-government entity and to any commercial
government-owned entity (except those that produce munitions), in any country except Afghanistan
(Taliban-controlled areas), Cuba, Iran, Iraq, Libya, North Korea, Serbia (except Kosovo), Sudan
and Syria.
For the latest information on United States cryptography export and import laws, contact the Bureau
of Export Administration (BXA) (http://www.bxa.doc.gov/).
For many years, the U.S. government did not approve export of cryptographic products unless the
key size was strictly limited. For this reason, cryptographic products were divided into two classes:
products with "strong" cryptography and products with "weak" (that is, exportable) cryptography.
Weak cryptography generally means a key size of at most 56 bits in symmetric algorithms. Note
that 56-bit DES keys have been cracked. In January 2000 the restrictions on export regulations
were dramatically relaxed. Today, any cryptographic product is exportable under a license
exception (i.e., , without a license) unless the end-users are foreign governments or embargoed
destinations (Cuba, Iran, Iraq, Libya, North Korea, Serbia, Sudan, Syria, and Taleban-controlled
areas of Afghanistan, as of January 2000). Export to government end-users may also be approved,
but under a license.
Q20. Why is the export of cryptography controlled ?
A20. Cryptography is export-controlled for several reasons. Strong cryptography can be used for criminal
purposes or even as a weapon of war. In wartime, the ability to intercept and decipher enemy
communications is crucial. Therefore, cryptographic technologies are subject to export controls.
U.S. government agencies consider strong encryption to be systems that use key sizes over 512
bits or symmetric algorithms (such as triple-DES) with key sizes over 56 bits. Since government
encryption policy is influenced by the agencies responsible for gathering domestic and international
intelligence (e.g., the FBI and NSA) the government tries to balance the conflicting requirements of
making strong cryptography available for commercial purposes while still making it possible for
those agencies to break the codes, if need be.
To most cryptographers, this level of cryptography (56 bits for symmetric algorithms) is not
necessarily considered ”strong''. Government agencies use the terms "strategic'' and "standard'' to
differentiate encryption systems. "Standard'' refers to algorithms that have been drafted and
selected as a federal standard (DES being the prime example). The US government defines
"strategic'' as any algorithm that requires "excessive work factors'' to successfully attack.
Unfortunately, the government does not frequently publish criteria for what it defines as
"acceptable'' or "excessive'' work factors.
Q21. Can digital signature applications be exported from the U. S. ?
A21. Digital signature applications are one of the nine special categories of cryptography that
automatically fall under the more relaxed Commerce regulations; digital signature implementations
using RSA key sizes in excess of 512 bits were exportable even before the year 2000. However,
there were some restrictions in developing a digital signature application using a reversible
algorithm (that is, the signing operation is sort of the reverse operation for encryption), such as
RSA. In this case, the application should sign a hash of the message, not the message itself.
Otherwise, the message had to be transmitted with the signature appended. If the message was
not transmitted with the signature, the NSA considered this quasi-encryption and the State controls
would apply.
Q22. Can DES be exported from the U.S. to other countries ?
A22. For years, the government rarely approved the export of DES for use outside of the financial sector
or by foreign subsidiaries of U.S. companies. Several years ago, export policy was changed to
allow the unrestricted export of DES to companies that demonstrate plans to implement key
recovery systems in a few years. Today, Triple-DES is exportable under the regulations described
above.
