ITARs and the Export of Classes and Methods

[tcmay@got.net (Timothy C. May)]

At 3:12 PM 4/30/96, Alex Strasheim wrote:
>>   Our Navigator 3.0 release will allow java and javascript to call into
>> plugins.  Since plugins are native code, you will be able to freely mix
>> C and Java.  Of course you will have to get the user to install your
>> plugin on their disk.
>
>That's the problem, installing the plugin.
>
>I (and some others, I think) was hoping that it would be possible to build
>powerful crypto applets and put them up on web pages.  That way everyone
>with a java enabled copy of Netscape could use a remailer or send crypted
>mail without having to download, install, and configure software.
>
>If people have to download and install a plugin to use a java mixmaster
>applet, why not just download and install a native mixmaster client?
>
>Of course there are other reasons to use java -- platform independence,
>for example.  But it's the user's ability to download and run applets just
>by jumping to a web page that has everyone excited.  With that gone (for
>crypto), java loses a lot of its lustre (again, for crypto work).

Hmmmhhh....

It may be--from the comments of Dan W. about the NSA, export, and Java, and
from other signs--that the NSA and its allies see the same opportunities
many of us see. And that they don't like what they see.

I hope Marianne and the other Sun and/or Netscape folks can keep us
informed on what, if anything, the NSA is telling them they can do with
Java and what they cannot do. Under the guise of "export," of course, as
there is no legal basis for restricting domestic (within the Greater Unites
States and Canada Coprosperity Sphere) crypto.

An interesting situation for the ITARs, if they try to restrict bignum
classes, for example. A class-based system, if done correctly (in whatever
language, e.g., C++ or Java), should have _most_ of the hard crypto work
already implemented in classes and methods (for bignums, modular
exponentiation, etc.), with the final crypto program much more easily
implemented and exported.

(I presume that PGP 3.0 is being done largely this way (class libraries),
and, speculatively, PGP 4.0 might be Java-based, and rely on small applets
calling the various classes.)

Does the battle for restricting exports of programs, a la PGP or Lotus
Notes, then shift to controlling the export of computer languages?!

--Tim May


Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."