I was reading a rather dated book on SSL/TLS, which mentions International Step Up certificates and Microsoft's Server Gated Certificates which were the way around the US export rules for economic transactions.
Now export rules still exist.
But I always saw that the browsers I have used have requested stronger cipher suites regardless of the server. Wikipedia's entry on Server Gated Cryptography says:
Today, SGC certificates are widely considered to be obsolete as browsers requiring enhanced encryption capabilities are all but extinct, and many parties contend that facilitating the use of older, insecure browsers creates more security concerns than it remedies. However, many certificate authorities continue to charge a premium for this kind of certificate. When an SSL handshake takes place, the software (e.g. a web browser) would list the ciphers that it supports. Although the weaker exported browsers would only include weaker ciphers in its SSL handshake, the browser did also contain stronger cryptography algorithms.
I really don't understand this paragraph.
- If US export laws still apply (and they do) how can the browsers use stronger crypto algorithms?
- What am I missunderstading here?
I always see the browser sending strong ciphers along with weak without the server having a special indication such as SGC.