Re: Crippled Notes export encryption

[Bill Stewart <stewarts@ix.netcom.com>]

At 01:18 PM 1/24/96 -0800, Jeff Weinstein <jsw@netscape.com> wrote:
>Mike Tighe wrote:
>> >  I can see two practical ways to build a netscape product outside
>> >  the US.  The first is to export the source code for the Navigator
>> >  with the crypto code removed.  ....
>> Didn't Netscape already promise to remove the hooks? It seems to me all of
>> the major software players are already in bed with the government.
>
>  What do you mean by "promise to remove the hooks"?

I think Mike's remembering the NCSA freeware httpd server which had the
crypto code removed at the NSA's request.  I don't remember if that was
before or after the Mosaic developers left to form Netscape, but being
an organization that gets government grant money subjects you to more
leverage than a random commercial company.

One seeming paradox of the law is that you're not allowed to export
"components of a cryptosystem", e.g. software with the crypto routines
removed but everything else there.  But you are allowed to export code
that the NSA has determined isn't strong enough to bother them,
including applications with wimpy cryptosystems.  The Clipper II escrow
standardization folks attempted to get industry to agree on
wiretap-enabled short-key software with tampering protection
in return for export permission, but as far as I know the current
not-officially-defined policy of 40 bits doesn't require that 
export-requesting software be non-modular; how much work would it be
to binary-patch-replace the 40-bit subroutines in current Netscape
with 128-bit subroutines?  (More work than just mailing the US version
overseas, I suppose :-)  Obviously Netscape couldn't do it themselves
if they wanted to ever get export permission again, but they could 
always issue a press release condemning the nasty foreigners for
hacking their product ("We're SHOCKED to discover that HACKING
is going on with our software!")
#--
#				Thanks;  Bill
# Bill Stewart, stewarts@ix.netcom.com, Pager/Voicemail 1-408-787-1281
#
# "Eternal vigilance is the price of liberty" used to mean us watching
# the government, not the other way around....