The tag has no usage guidance.

learn more… | top users | synonyms

4
votes
0answers
250 views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
1
vote
0answers
201 views

How to unwrap exported key from safenet HSM? [closed]

I am trying to write a software that will inject keys generated inside an HSM into a POS device, in the same way as described here I'm using the Safenet emulator(software-mode) + the wrap/unwrap ...
0
votes
2answers
79 views

FREAK attack - why doesn't Finished message prevent it?

Here is my understanding of FREAK (let me know if I'm right please): 1) Client wants to use modern RSA in ClientHello 2) MITM forwards Export_RSA 3) Server says ok and sends an export RSA key, ...
2
votes
1answer
2k views

SSL cipher suite: what does “export” mean?

I saw a cipher suite EXP-EDH-RSA-DES-CBC-SHA, EXP stands for export, How do I explain the "export"? What is the different between "EXP-EDH-RSA-DES-CBC-SHA" and "EDH-RSA-DES-CBC-SHA"?
1
vote
4answers
412 views

When do governments allow export of cryptography software?

I see this notice in the TextSecure README: The U.S. Government Department of Commerce, Bureau of Industry and Security (BIS), has classified this software as Export Commodity Control Number (ECCN) ...
1
vote
1answer
560 views

Export ciphers prevalance

I would like to clarify the consequences of not supporting export ciphers. When I run a qualys ssl test on ebay.com, I notice that the following cipher suites are supported. ...
4
votes
2answers
772 views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
-3
votes
1answer
186 views

US Export Laws (Encryption Cloud Service) [closed]

Okay - so I have been extensively looking into US export/import laws relating to encryption software (5D992), however I have a few questions about the laws and their applicability. So, the laws ...
2
votes
1answer
67 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
3
votes
3answers
745 views

Why have export controls for cryptography?

I've always heard someone justify the means for export restrictions with "it's for governmental control/spying". In most reasonable countries, the justice system asks people to adhere to the "spirit ...
3
votes
2answers
181 views

What International laws should one in the InfoSec industry we be aware of?

What InfoSec regulations should one be aware of when dealing with 'live' cross-border communications, or the offline transport of information?