3 ms·

The Sun patent appears to be listed on Oct 19, 1999. Out of curiosity, when did the compliance discussions with the NSA occur? (I'm quite interested in '90s cr

The Sun patent appears to be listed on Oct 19, 1999. Out of curiosity, when did the compliance discussions with the NSA occur? (I'm quite interested in '90s crypto/political interaction, and had thought that by '99, the NSA and State/Export restrictions had been mostly lifted, but I'd love to learn more from the inside).

ChuckMcM 13y ago
I was building a strong crypto package for Java in '93-'94. It was part of a capabilities system for Java which would have had the JVM unable to decrypt/instantiate methods in classes for which capabilities had not been granted. I modelled it on the Joule system which Mark Miller had worked on earlier. In late 1991/ early 1992 Sun had engaged RSA Data Security for a license to use their asymmetric crypto system we know as the RSA algorithm. I had started that because I was building a high trust authentication system for our name service (NIS+) and I really wanted to be able to pass around public keys for servers that a client trusted to be legitimate. When I started working on Java security in 1993 I sought to use some of those same techniques in creating a way for the JVM to "load" a cryptographic class which it could trust, and the class could validate that the JVM loadinging was trustable as well (avoiding MITM attacks). Since I had already been engaged with the issues of shipping crypto code in ONC-RPC, I knew it would be an issue to release source code that implemented arbitrarily strong RSA so when it came up, the NSA came out to talk to us. Our "rep" was a woman (and I'm not making this up) named Cindie Spies. She understood what I wanted to do but wasn't particularly keen on us doing it. We went back and forth with me sending code to her, and her sending back suggestions. It was a tedious process and ultimately moot since the capabilities version of Java never actually shipped.
- ewoodrich 13y ago
  Fascinating stuff. The "Cindie Spies" negotiations (and not just the spot-on name) provide good context for what it would be like developing crypto in a tumultuous, formative period for our current security technology/regulations.
yuhong 13y ago
It wasn't, it was just raised to 56-bit from 40-bit.
- ewoodrich 13y ago
  "In 1999, all restrictions on key length were lifted, except for exports to embargoed countries." [1] http://en.wikipedia.org/wiki/56-bit_encryption http://en.wikipedia.org/wiki/56-bit_encryption If you have a source that contradicts this, I'm all ears. I'd just always believed (based on what I've read) that the period from '96-'99 opened up arbitrarily strong crypto (excluding embargos/restrictions to states like North Korea).
  - yuhong 13y ago
    http://www.nytimes.com/2000/01/31/business/worldbusiness/31iht-ttcrypto.2.t.html http://www.nytimes.com/2000/01/31/business/worldbusiness/31i...
    - ewoodrich 13y ago
      "Further relaxation of encryption export controls took place in September 1999, when the Clinton Administration announced that encryption items of any key length may now be exported under a license exception, after a technical review, to individuals, firms, and other non-government end-users in any country except for seven state supporters of terrorism.25 After a technical review, retail encryption commodities and software of any key length will also be exportable under a license exception to any recipient in any country except for the same seven destinations." http://www.au.af.mil/au/awc/awcgate/crs/rl30273.pdf http://www.au.af.mil/au/awc/awcgate/crs/rl30273.pdf I think we're pretty much in agreement, considering that the time period between Sep. '99 and Jan '00 is about the length of time for new policy to fully propagate. Regardless, the latter portion of '99 and early '00 was when NSA and State/Export restrictions had been lifted.
  - dunham 13y ago
    I know there are some hoops you have to jump through if you're selling an iOS app that uses encryption, which arguably could include HTTPS. There is a registration/approval process, but an exemption for certain cases. More details here: http://stackoverflow.com/questions/9609901/when-to-check-the-this-application-uses-encryption-box http://stackoverflow.com/questions/9609901/when-to-check-the...

ChuckMcM 13y ago

I was building a strong crypto package for Java in '93-'94. It was part of a capabilities system for Java which would have had the JVM unable to decrypt/instantiate methods in classes for which capabilities had not been granted. I modelled it on the Joule system which Mark Miller had worked on earlier. In late 1991/ early 1992 Sun had engaged RSA Data Security for a license to use their asymmetric crypto system we know as the RSA algorithm. I had started that because I was building a high trust authentication system for our name service (NIS+) and I really wanted to be able to pass around public keys for servers that a client trusted to be legitimate. When I started working on Java security in 1993 I sought to use some of those same techniques in creating a way for the JVM to "load" a cryptographic class which it could trust, and the class could validate that the JVM loadinging was trustable as well (avoiding MITM attacks). Since I had already been engaged with the issues of shipping crypto code in ONC-RPC, I knew it would be an issue to release source code that implemented arbitrarily strong RSA so when it came up, the NSA came out to talk to us. Our "rep" was a woman (and I'm not making this up) named Cindie Spies. She understood what I wanted to do but wasn't particularly keen on us doing it. We went back and forth with me sending code to her, and her sending back suggestions. It was a tedious process and ultimately moot since the capabilities version of Java never actually shipped.

ewoodrich 13y ago
Fascinating stuff. The "Cindie Spies" negotiations (and not just the spot-on name) provide good context for what it would be like developing crypto in a tumultuous, formative period for our current security technology/regulations.

yuhong 13y ago

It wasn't, it was just raised to 56-bit from 40-bit.

ewoodrich 13y ago
"In 1999, all restrictions on key length were lifted, except for exports to embargoed countries." [1] http://en.wikipedia.org/wiki/56-bit_encryption http://en.wikipedia.org/wiki/56-bit_encryption If you have a source that contradicts this, I'm all ears. I'd just always believed (based on what I've read) that the period from '96-'99 opened up arbitrarily strong crypto (excluding embargos/restrictions to states like North Korea).
- yuhong 13y ago
  http://www.nytimes.com/2000/01/31/business/worldbusiness/31iht-ttcrypto.2.t.html http://www.nytimes.com/2000/01/31/business/worldbusiness/31i...
  - ewoodrich 13y ago
    "Further relaxation of encryption export controls took place in September 1999, when the Clinton Administration announced that encryption items of any key length may now be exported under a license exception, after a technical review, to individuals, firms, and other non-government end-users in any country except for seven state supporters of terrorism.25 After a technical review, retail encryption commodities and software of any key length will also be exportable under a license exception to any recipient in any country except for the same seven destinations." http://www.au.af.mil/au/awc/awcgate/crs/rl30273.pdf http://www.au.af.mil/au/awc/awcgate/crs/rl30273.pdf I think we're pretty much in agreement, considering that the time period between Sep. '99 and Jan '00 is about the length of time for new policy to fully propagate. Regardless, the latter portion of '99 and early '00 was when NSA and State/Export restrictions had been lifted.
- dunham 13y ago
  I know there are some hoops you have to jump through if you're selling an iOS app that uses encryption, which arguably could include HTTPS. There is a registration/approval process, but an exemption for certain cases. More details here: http://stackoverflow.com/questions/9609901/when-to-check-the-this-application-uses-encryption-box http://stackoverflow.com/questions/9609901/when-to-check-the...