Re: rc2 export limits..

[Kent Briggs <72124.3234@compuserve.com>]

-----BEGIN PGP SIGNED MESSAGE-----

Bill Stewart wrote:
> 
> I'm afraid my source is "Read it on the net and was surprised to hear it".
> My assumption is that the limit is for software that implements
> both signature and verification, since ITAR doesn't ban export of
> pure-authentication software.
> 
> Is the State Dept doc on the net?  It would be nice to have something
> saying there are well-defined rules that they agree to follow,
> unreasonable and unconstitutional though they may be.
> 

I'm still skeptical that such a restriction (1024-bit signatures)
exists.

If I recall, I originally found the State Dept. doc on the EFF site
under a heading of CJ Export kit or something similar.  I don't know 
if it is still there but it was out of date anyway as the contact in 
it had retired.

You can probably contact the DoS and have them mail you one (as I did):

Attn: Sam Capino
U.S. Department of State
Office of Defense Trade Controls
PM/DTC Room 200
1700 N. Lynn Street
Arlington, VA  22209-3113
Voice: 703-875-7396
Fax: 703-875-6647
  
The procedure is 5 pages and titled "Procedure for Submitting a
Commodity Jurisdiction Request for a Mass Market Software Product 
that contains Encryption"

When using RC2 and/or RC4, you have to request a separate test vector
sheet titled "Supplemental Form for Mass Market Software Expedited 
Review" for each CJ request.

Kent

P.S.  Does anyone know how to turn off this Gratis auto-signing
service?  I keep getting double posts when replying directly
to the list via Netscape to hks.lists.cypherpunks.
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMi8L4SoZzwIn1bdtAQF8PQGAl4952bwt/PJofD21qR+sAF0jStgUs76I
NY9sfnXFcNHrFdgs6eEXHZ/lv3cstnnt
=W0Ug
-----END PGP SIGNATURE-----