O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 6] 6.7 Encryption and U.S. Law
Department; publishing the same algorithm in a book or public paper is not controlled.
To get a license to export a program, you disclose the program to DTC, which then makes an evaluation.
(In practice, these decisions are actually made by the National Security Agency.) Historically, programs
that implement sufficiently weak cryptography are allowed to be exported; those with strong
cryptography, such as DES, are denied export licenses.
A 1993 survey by the Software Publisher's Association, a U.S.-based industry advocacy group, found
that encryption is widely available in overseas computer products and that availability is growing. They
noted the existence of more than 250 products distributed overseas containing cryptography. Many of
these products use technologies that are patented in the U.S. (At the time, you could literally buy
high-quality programs that implement RSA encryption on the streets of Moscow, although Russia has
since enacted stringent restrictions on the sale of cryptographic programs.)
Table 6.4: The Public Key Cryptography Patents
Patent # Title Covers Inventors Assignee Date Date Date
Invention
Filed Granted Expires
4,200,770 Cryptographic Diffie-Hellman Martin E. Stanford September April 29, April 29,
Apparatus and key exchange Hellman, University 6, 1977 1980 1997
Method
Bailey W.
Diffie,
Ralph C.
Merkle,
4,218,582 Public Key Knapsack, and Martin E. Stanford October 6, August August
Cryptographic possibly all of Hellman, University 1977 19, 1980 19, 1997
Apparatus and public key Ralph C.
Method cryptography Merkle
4,424,414 Exponentiation
Martin E. Stanford May 1, January 3, January 3,
Cryptographic
Hellman, University 1978 1984 2001
Apparatus and
Stephen
Method
C. Pohlig
4,405,829 Cryptographic RSA Ronald L. Massachusetts December September September
Communications encryption Rivest, Institute of 14, 1977 20, 1983 20, 2000
System and
Adi Technology
Method
Shamir,
Leonard
M.
Adleman
Most European countries used to have regulations regarding software similar to those in force in the U.S.
Many were discarded in the early 1990s in favor of a more liberal policy, which allows mass-market
software to be freely traded.
In 1992, the Software Publishers Association and the State Department reached an agreement which
allows the export of programs containing RSA Data Security's RC2 and RC4 algorithms, but only when
the key size is set to 40 bits or less. 40 bits is not very secure, and application of a distributed attack using
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch06_07.htm (2 of 3) [2002-04-12 10:45:23]