Re: Why not PGP?

At 11:01 AM 10/10/96 -0600, Rollo Silver wrote:
>I use PGP to communicate (presumably) strong-cryptoed messages to my
>stepson Ray Hirschfeld in Amsterdam, and vice versa. He uses an
>internationational version of PGP, and I use the domestic version that I
>got from MIT. They seem to be compatible.

They are.


>I don't intend to submit my present or future private PGP keys for key
>escrow (Is that what's called GAK?). 

GAK stands for Goverment Access to Keys.  Key escrow is a term used in
government circles to avoid that truth.


>1. Does anyone think that legislation might be passed which would
>criminalize my communications with Ray?

Such communication was illegal during world war 2.  Your belief in furture
government (in)action depends on your trust of the government.


>2. Suppose someone writes a program Z that has no expicit crypto code in
>it, but has hooks for installing one or another version of PGP. Given a
>copy of Z, someone in this country could install PGP he got from MIT,
>whereas someone in Europe could install the international version.
>Would export of Z violate ITAR restrictions?

Yes


-------------------------------------------------------------------------
Bill Frantz       | "Cave softly, cave safely, | Periwinkle -- Consulting
(408)356-8506     | and cave with duct tape."  | 16345 Englewood Ave.
frantz@netcom.com |           - Marianne Russo | Los Gatos, CA 95032, USA

Bill Frantz <frantz@netcom.com> writes:
> >2. Suppose someone writes a program Z that has no expicit crypto code in
> >it, but has hooks for installing one or another version of PGP. Given a
> >copy of Z, someone in this country could install PGP he got from MIT,
> >whereas someone in Europe could install the international version.
> >Would export of Z violate ITAR restrictions?
> 
> Yes

I agree.  However let me elaborate for Rollo: with ITAR there are at
least three aspects:

- what ITAR says

  It says for instance that you can not _talk_ to a foreign national in
  the US about crypto, that you can not show them books, that you can
  not export books etc.  We know this is not enforced (they tried it a
  few times and gave up).  We know books are allowed to be exported,
  examples: Bruce Schneier's Applied Crypto (crypto source code, never
  mind technical descriptions, which ITAR says are illegal to export
  or disclose to foreigners "Disclosing (including oral or visual
  disclosure)" Phil Zimmermann/MIT's PGP source code and internals
  book, the full source code to PGP itself in an OCR font) They don't
  enforce books or discussions anymore because of the clear 1st
  ammendment case against this behaviour.

- and what the NSA, and US government care to interpret ITAR as
  meaning today (they change to suit the case at hand, keeping their
  interpretation purposefully vague)

- what they care to enforce

  NCSA Mosaic had a PGP signature checking hook, they were told to
  take it out.  Microsoft's CAPI arrangement is that they will not
  sign non-US CAPI compliant crypto modules (Examples of enforcement of
  no-hooks interpretation).

  emacs mailcrypt is exported form the US (Emacs RMAIL/GNUS interface
  to PGP - just plug in pgp263i or mit pgp262, an example of
  non-enforcement of no-hooks interpretation)

Adam
--
#!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj
$/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1
lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)