MyCERT 3rd Quarter 2011 Summary Report - CyberSAFE Malaysia

8Legal Restriction on CryptographyBY | Liyana Chew Binti Nizam Chew, Abdul Alif Bin ZakariaIntroductionHistorically, a number of countries haveattempted to restrict the export or importof cryptography tools. This article aimsto give a general view on the existingrestrictions on cryptography tools.Export restrictions are totally differentfrom imports. Restrictions on exportsare referring to restrictions on exportingcryptographic tools out of countries thatproduce them. Meanwhile restrictions onimports refer to a country that receivescryptography tools for their needs. Thisarticle will also discuss the reasons whycertain countries do apply these restrictionswhile other doesn’t.Restriction On ExportThe export of cryptography is a transferof devices and technology related tocryptography from one country to anothercountry. In the early days of the Cold War,the U.S government developed an elaborateseries of export control regulationsdesigned to prevent a wide range ofWestern technology from falling into thehands of others. U.S non-military exportsare controlled by Export AdministrationRegulations (EAR). Encryption itemsspecifically designed, developed,configured, adapted or modified formilitary applications (including command,control and intelligence applications) arecontrolled by the Department of State onthe United States Munitions List.U.S government set a restriction on exportof cryptography product with strict limiton the key size. In general, products andtechnologies with exportable cryptographyprovide much less security than the nonexportableversion of the same productsand technologies. Non-exportable versionof cryptography product use longer keylength (128 bits) than exportable (40 bits or56 bits) version. Communication betweenthese two versions is limited to the longestkey length supported by the exportableversion. As reported in The New York Timeson December 1998, U.S and European Union(EU) officials have reached an agreement onexport controls for cryptography software.Both blocs agreed to restrict the export ofencryption software that uses keys of 64 bitsor more. U.S law currently forbids companiesfrom exporting software that uses that levelof encryption. That’s why US versions ofWeb browsers contain 128-bit encryptionto encode e-commerce transactions, butEuropean versions use a much lower levelof security (40 bits key). The agreement,reached by the 33 members of the WassenaarArrangement, will impose those exportrestrictions on European software suppliers.The more bits in the key, the harder it is tocrack. The US government claims 64-bit keysare sufficient for almost all uses. However,research proves that it is possible to breaka 56-bit code, albeit using a network ofhundreds of PCs operating in parallel. Muchtougher keys, including the 128-bit keyscommonplace in e-commerce applications,are thought to be virtually impossible tocrack using today’s technology through thenext few generations of processor.Until January 2000, the export restrictionsof Cryptography in the U.S becomemore relaxed. Export to end-users isapproved under a license except to foreigngovernments or embargoed destinations thelikes of Cuba, Iran, Iraq, Libya, North Korea,Serbia, Sudan, Syria, and Taliban-controlledareas of Afghanistan.e-Security | Cyber Security Malaysia | Vol: 28-(Q3/2011)© CyberSecurity Malaysia 2011 - All Rights Reserved