Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've always heard someone justify the means for export restrictions with "it's for governmental control/spying". In most reasonable countries, the justice system asks people to adhere to the "spirit of the law".

What is "spirit of the law" regarding cryptography I should be aware of?

Are there any themes that are common, outside a countries borders?

Possible answers may be

  • the protection of Intellectual Property
  • the desire to protect corporate assets in a given country (as these businesses pay taxes)
  • to protect the online identity of their citizens (in the case of certificates issued to individuals).

For those people doing business in unreasonable countries, I'll bet they have more worries than just the cryptographic security of your data.... so I don't think there is any "spirit of the law" to be concerned about.

share|improve this question
    
Related: List of cryptography laws by country –  makerofthings7 May 30 '12 at 20:51

2 Answers 2

up vote 4 down vote accepted

Export regulations are the offspring of international treaties, in particular the Wassenaar Arrangement. The idea is that once countries decide that strong cryptography must be regulated within their borders, these countries make deals with other countries so that those other countries do not recklessly export strong cryptographic products, neither to them, nor to third parties who are deemed "not trustworthy enough" to receive them (e.g. the arrangement restricts export from USA to France and also from USA to North Korea, but not for the same reasons !).

Cryptography is here treated as if it was a kind of assault rifle. Indeed, until about a dozen years ago, cryptography was officially classified by the USA as ammunition. This implies the same kind of controls than those for importing or exporting weapons.

We can thank (or curse) the Web, and especially the whole let's-buy-things-on-the-Web business, for the normalization of cryptography: most crypto-related regulations which have been passed in the last decade have been designed so that it became legal to provide, export and import Web browsers with SSL support, for non-joke key lengths. Legislative bodies around the world are slowly coming to the realization that cryptography is not necessarily a bad guy tool; individuals and corporations may be entitled to use them for their own protection, too, especially in areas where more classical law enforcement agencies do not have the technical means to ensure the safety of everybody. SSL is legal because there is no practical way to proactively prevent eavesdropping.

share|improve this answer
4  
For those that don't know, one of the key milestones was the effective release of PGP to the world not by the Internet, but by publication in books - en.wikipedia.org/wiki/Pretty_Good_Privacy#History –  Rory Alsop Sep 29 '11 at 21:13
    
Your first paragraph looks like the US forbids exporting Crypto products to Syria, North Korea etc. because these countries does not want them there. The second paragraph (and the Wikipedia article) is clearer, but you might want to clarify the first one. –  Paŭlo Ebermann Sep 30 '11 at 0:23
    
@Paulo: done. Actually I meant both reasons. –  Thomas Pornin Sep 30 '11 at 1:16
    
With the disclaimer that none of us are lawyers per se, should I interpret that "spirit of the law" as being acceptable use, for the purpose of self-protection from eavesdroppers? If so, what kind of eavesdroppers: Criminals or government-funded eavesdroppers? Does that imply that a certain technology (or bit-level) defines who we're protecting ourselves from... and therefore may be observed as hiding from a particular state? Are cryptographic control laws in this regard subjective or objective? –  makerofthings7 Sep 30 '11 at 1:53
    
@ThomasPornin - O.T. I went to your website and downloaded some of your software/code out of similar curiosity. Also clicked a bunch of links. Can you share more info about your experience with France and what crypto can't be exported from US? –  makerofthings7 Sep 30 '11 at 1:59

The answer to the question is because the governments mandates it.

There was a time here in the US when the government was hobbled by “gentlemen don't read each other's mail" but the lessons of millions dead due to global war in the last century followed by thermonuclear brinksmanship nullified that quant idiom. Thus we find ourselves living in a time that cryptographic technology is seen at the state level as potentially enhancing the abilities of the state's enemies.

It is not a simple task to quarantine a scientific idea or computer algorithm but that is the only tool the state has at its disposal. Ideas tend to escape such controls but whether it is nuclear weapons design or the crypto used to tramsmit that design they fall under state control. As those details escape the world becomes a more complicated place for the state.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.