Front cover - IBM Redbooks

30 Lotus Security Handbook
As a follow-up to this, there was a November 18, 1998 announcement by the
Bureau of Export Administration of the Commerce Department that amended the
export administration regulations for exports and re-exports of strong encryption
commodities and software. The key lengths are now full 56 bits for DES and
“equivalent” bulk ciphers (namely RC2, RC4, RC5 and CAST) and 1,024 bits for
RSA asymmetric keys to all destinations except Cuba, Iran, Iraq, Lybia, North
Korea, Sudan, and Syria. This is also under the proviso that there be no key
recovery possible. As well, unlimited strength crypto keys can be used by US
subsidiaries, Insurance companies, health and medical firms and online
merchants, provided they do not have a presence in any of the previously listed
countries.
Moving forward, on June 6, 2002, the Bureau of Industry and Security (BIS)
published a rule which amended the Export Administration Regulations (EAR) to
reflect changes made to the Wassenaar Arrangement List of dual-use items and
to update and clarify other provisions of the EAR pertaining to encryption export
controls.
Mass market encryption commodities and software with symmetric key lengths
exceeding 64 bits that are classified under Export Control Classification Numbers
(ECCNs) 5A992 and 5D992 may be exported and reexported No License
Required (NLR), following a 30-day review by the BIS. This rule updates
Category 5, part II (Information Security) of the Commerce Control List (CCL),
and will also allow equipment controlled under ECCN 5B002 to be exported and
reexported under License Exception ENC.
For more information, here is a complete list of resources that will shed some
light on export regulations and bilateral agreements currently in place:
► The Published Federal Registers - Rules affecting the Export Administration
Regulations can be found at the following URL:
http://w3.access.gpo.gov/bis/fedreg/ear_fedreg.html#67fr38855
► An Encryption Fact Sheet pertaining to Commercial Encryption Export
Controls can be found at the following URL:
http://www.bxa.doc.gov/encryption/EncFactSheet6_17_02.html
► Explanation of the Wassenaar arrangement and what it involves can be found
at the following URL:
http://www.bxa.doc.gov/Wassenaar/Default.htm
1.4.3 Asymmetric key algorithms
A non-mathematician can intuitively understand how a symmetric key algorithm
works by extrapolating from a familiar base. However, asymmetric key
algorithms are much less accessible to the lay person. In fact, it sometimes