Re: Exporting from Canada (was Re: Let's try breaking an SSL RC4 key)

-----BEGIN PGP SIGNED MESSAGE-----

In article <m0saTpk-0005BTC@nrk.com>, wb8foz@nrk.com (David Lesher) wrote:

>marc:
>> However, goods of U.S. origin are export restricted, unless said
>> goods are further processed outside the U.S. so as to result in a
>> substantial change in value, so some of the PGP development would
>> need to be done in Canada.
>
>How about compiling it? THAT is "further processing"......

I am not sure that would hold. After all, the disk with the source code to
"Applied Cryptography" was denied an export license, because the source
code could be compiled into libraries.
<What kind of drugs are these people on anyway? They really ought to quit.>

- -- 
- -- Lucky Green <mailto:shamrock@netcom.com>
   PGP encrypted mail preferred.
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMBR5PCoZzwIn1bdtAQGSygGAs0JN64qoFfzC0OEL+yV5p/iWecnTtBeJ
Fm8a7jsIqtV+FsQg7ATQRcpSxtDOnbS2
=He6y
-----END PGP SIGNATURE-----

In message <199507250455.AAA13908@bb.hks.net> Lucky Green writes:
>
>In article <m0saTpk-0005BTC@nrk.com>, wb8foz@nrk.com (David Lesher) wrote:
>
>>marc:
>>> However, goods of U.S. origin are export restricted, unless said
>>> goods are further processed outside the U.S. so as to result in a
>>> substantial change in value, so some of the PGP development would
>>> need to be done in Canada.
>>
>>How about compiling it? THAT is "further processing"......
>
>I am not sure that would hold. After all, the disk with the source code to
>"Applied Cryptography" was denied an export license, because the source
>code could be compiled into libraries.

So?  The ITAR doesn't control export to Canada.  Export the source code
to Canada, compile, validate, sign, and put on CD in Canada, and export
to the world.

I also seem to remember a while back (Mar/Apr) someone reported here that the
Canadian bureaucrat responsible for executing import/export rules said
that he didn't consider crypto to be restricted by Canada's rules.

> So?  The ITAR doesn't control export to Canada.  Export the source code
> to Canada, compile, validate, sign, and put on CD in Canada, and export
> to the world.

No. Export of crypto to Canada is legal because Canada prohibits the
further export of goods of U.S. origin. Before the Canadian government
will allow further export of crypto software from the U.S., there must
be lot of improvement done to the product within Canada. The exact
rules are not well defined, but with crypto I expect that the CSE
(Communications Security Establishment -- our version of the NSA)
would push for at least 50% Canadian content. So I don't expect to
see PGP being exported legally any time soon.
 
> I also seem to remember a while back (Mar/Apr) someone reported here that the
> Canadian bureaucrat responsible for executing import/export rules said
> that he didn't consider crypto to be restricted by Canada's rules.

I have talked with the bureaucrat that I think you are referring
to, and he said no such thing. He said that public domain crypto
software that is entirely of Canadian origin was, in his opinion
not covered. When I talked to him, he stressed that PGP is still
covered.
--
	-marc