6 ms·

"a quirk of the U.S. legal system meant that cryptography was, until the late 1990s, placed on the U.S. Munitions List, alongside semi-automatic firearms and ta

"a quirk of the U.S. legal system meant that cryptography was, until the late 1990s, placed on the U.S. Munitions List, alongside semi-automatic firearms and tanks." This was no quirk. The US government made deliberate efforts to limit the availability of encryption software, even adding it to international export control lists where it previously did not exist: http://cryptome.org/jya/wass-suks.htm http://cryptome.org/jya/wass-suks.htm

colechristensen 12y ago
I may be outspoken on this, but I think that it was an appropriate move to keep cryptography (or some kinds of cryptography) on such munitions lists.
- shard972 12y ago
  Can you explain why you think that?
  - derefr 12y ago
    The US makes a lot of money from the government allowing defense contractors to sell the stuff they design for it to its allies as well. The munitions-export provisions exist because, although we aren't too worried about our allies reselling the tents or latrines we send them to our enemies, we really don't like the idea of having the guns we've manufactured pointed back at us. A secure softphone implementing http://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography http://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography is a lot more like a gun than it is like a tent or a latrine, in terms of what an enemy nation that gets their hands on it will do with it.
    - shard972 12y ago
      So, would that also cover citizens? As in, if I made my own encryption method and then supplied that to some friends overseas, would that be violating munitions exporting if crypto was still covered?
      - colechristensen 12y ago
        Essentially, yes. A well educated person with the motivation and no cooperation from existing tech is very much capable of making the state department rather unhappy by exporting their own creation.
        shard972 12y ago
        Well I suppose thats what we live for, to keep the state department happy.
    - judk 12y ago
      The Afghan Taliban and Saddam Hussein were armed by the USA. "Ally" and "Enemy" are transient labels. Cryptography is far more like body armor than it is like a gun.
      - yardie 12y ago
        The "Taliban" were never armed by the US. There were some members who were US allies during the Soviet-Afghan war. Just like they are some members of the Northern Alliance, US ally during the Afghan campaign, that were allies of the Soviet Union. In the end one war ended and groups broke up. Then the next war came and alliances had changed.
        pjakma 12y ago
        The US funnelled hundreds of millions of $ through Pakistan to help fund the Mujahideen in Afghanistan. The CIA also provided direct support, in training and weapons, etc. https://en.wikipedia.org/wiki/Operation_Cyclone https://en.wikipedia.org/wiki/Operation_Cyclone Here's an Afghan with a Stinger missile (and there are lots of similar photos), not sold on the open market then, could realistically only have been acquired in bulk with US government assistance: http://tkfiles.storage.msn.com/y1pUt0liKawcr-ryBplDmzAGeFbxGpv3kgnqKuP6w2HdvM_snddyLIwB-FYJ5BkDWn4Fnr4buch5q8 http://tkfiles.storage.msn.com/y1pUt0liKawcr-ryBplDmzAGeFbxG...
        arca_vorago 12y ago
        The names may have changed but the people didn't. We funded Gulbuddin Hekmatyar, and provided numerous FIM-92 stingers which after the war was over turned into the buyback fiasco, where many of these stingers were never recovered. Not to mention the third-party plausible denability effect, through which arms may not have passed directly to "Muj" or Taliban, but were supplied by the US. So to say the "Taliban" were never armed is completely factually incorrect, both in relevance to the Soviet war and the current one. If you want to learn more about the US involvement as the number one arms dealer in the word, the revised Shadow Factory book is out and worth the long read.
        12y ago
  - colechristensen 12y ago
    Few things are more valuable in war than the secrecy of long distance communications. Though we haven't been at a conflict which posed any credible threat for the better part of a century, holding on to technological advantages when they're fresh is in our best interest and in the best interest of the American Peace we have going.
    - VMG 12y ago
      Computer technology alone is extremely valuable, would you be OK with restricting the export of that?
      - colechristensen 12y ago
        It's fairly unfortunate that a majority of computer technology is imported from foreign manufacturers for many reasons, but export control isn't really one of them. Supercomputers, yes ... general components... not particularly. In a lot of ways 'modern' computer technology isn't all that essential. It certainly isn't present in a whole lot of our military hardware because of realities of acquiring and maintaining such hardware _and_ the lack of an exponential increase of computing needs to match capabilities. In fewer words, computer technology is valuable, but not extremely so. Restricting the flow of anything remotely related to consumer computer tech wouldn't have much benefit, even if it were possible considering most of it is made in Asia.
        VMG 12y ago
        Then just focus on basic computer technology. Restricting the export of semiconductors in the early 60s could have created a significant advantage for the US, but would be absurd to support a decision like that. Military benefit alone is not enough to justify an export restriction, one has to consider the cost on society as a whole. The cost of restricting the export of cryptography is too large to justify.
        jimktrains2 12y ago
        > Supercomputers, yes ... general components... not particularly. There isn't a terribly large difference anymore except for size and tuning.
- VMG 12y ago
  The kind of cryptography that lets people communicate securely? Belongs on the same list as physical objects that intended to pierce walls and flesh? I'd also like a more in-depth explanation.
  - colechristensen 12y ago
    >The kind of cryptography that lets people communicate securely? I don't know of any other kinds of cryptography... >Belongs on the same list as physical objects that intended to pierce walls and flesh? War has a lot less to do with shooting people and a lot more to do with information than you seem to appreciate. The public algorithms are public and there is no need or usefulness in export restrictions now on things known worldwide (and the usefulness of such restrictions was gone for a considerable time before they were lifted).
    - VMG 12y ago
      War has a lot to do with all kinds of things, however optimizing your country for warfare imposes a high cost on civil life and the economy. You failed to justify the decision of restricting the export of cryptography and the associated costs of that.
      - 001sky 12y ago
        This seems a bit harsh, perhaps. Bletchley park was still in the minds of many people. It would have been conventional wisdom to keep this stuff away from "bad guys". Recall, gps was spoofed at this stage as well for civilian purposes. The other issue--although perhaps unsaid--is that ultimately this may have hastened tactics to make HW unsecure, and to collect undisclosed/zero day expoits in widespread SW and other things that could compromise a comms system that was perceived to be secure.
        TeMPOraL 12y ago
        Side-note: nice easter egg on Google when you search for "Bletchey park". Look at the "knowledge graph" result on the right.
- deleted 12y ago
  [deleted]
- exelius 12y ago
  It kind of made sense during the pre-Internet Cold War days when the only people with use for strong cryptography were nations and their militaries. These days it's just silly.
gioele 12y ago
We should remember that DJB was a key person in making cryptography fully legal in the US. «The State Department was unsympathetic to Bernstein's situation and told Bernstein he would need a license to be an arms dealer before he could simply post the text of his encryption program on the Internet. They also told him that they would deny him an export license if he actually applied for one, because his technology was too secure. The Electronic Frontier Foundation pulled together a top-notch legal team and sued the United States government on behalf of Dan Bernstein. The court ruled, for the first time ever, that written software code is speech protected by the First Amendment. The court further ruled that the export control laws on encryption violated Bernstein's First Amendment rights by prohibiting his constitutionally protected speech. As a result, the government changed its export regulations.» From https://www.eff.org/about/history https://www.eff.org/about/history http://cr.yp.to/export/status.html http://cr.yp.to/export/status.html http://en.wikipedia.org/wiki/Bernstein_v._United_States http://en.wikipedia.org/wiki/Bernstein_v._United_States
- 001sky 12y ago
  Decided: December 9, 1996
- interesting_guy 12y ago
  Berenstain Bear
- uuid_to_string 12y ago
  So who should we entrust with protecting our communications over the open Internet? The US defense contractor and the reclusive gentleman in the UK whose code (for whatever reasons) has a rather poor security record, or the math professor whose code (qmail, daemontools, djbdns, etc.) generally has an excellent security record? Who enforces better quality control? Does that matter? Or maybe we should be asking how much these men are paid? (As are the journalists and their readers.) We know from the statements of the US Steve that the UK Steve does not get paid much for his work. Maybe it's really not about the money? Nevermind. I'm sure the journalists have it right.
vishnugupta 12y ago
I believe (citation needed :-)) there was (is?) restriction on the maximum length of private key. This was arrived at based on the computing resources available with NSA so that they be able to break a cypher by brute force. There's a very interesting passage in the book "The Code Book" towards the end as to how the inventor of PGP was harassed by slapping him with charges under Arms Export Control Act[1]. Zimmermann's law [2] is also very relevant to be mentioned here. [1] http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_investigation http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_invest... [2] http://en.wikipedia.org/wiki/Phil_Zimmermann#Zimmerman.27s_Law http://en.wikipedia.org/wiki/Phil_Zimmermann#Zimmerman.27s_L...
- trevelyan 12y ago
  Yeah. I seem to remember the limit being 64-bit at the time, although maybe it was only 56-bit. Netscape used to have different download links for "American" and "International" users and put up a stern warning on the US link saying that international users couldn't grab it. So, of course, everyone just downloaded the American edition... :)
  - pdw 12y ago
    The limit was 40 bit. DES was 56 bit and "international" implementations zeroed out 16 bits of the key to make it exportable.

colechristensen 12y ago

I may be outspoken on this, but I think that it was an appropriate move to keep cryptography (or some kinds of cryptography) on such munitions lists.

shard972 12y ago
Can you explain why you think that?
- derefr 12y ago
  The US makes a lot of money from the government allowing defense contractors to sell the stuff they design for it to its allies as well. The munitions-export provisions exist because, although we aren't too worried about our allies reselling the tents or latrines we send them to our enemies, we really don't like the idea of having the guns we've manufactured pointed back at us. A secure softphone implementing http://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography http://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography is a lot more like a gun than it is like a tent or a latrine, in terms of what an enemy nation that gets their hands on it will do with it.
  - shard972 12y ago
    So, would that also cover citizens? As in, if I made my own encryption method and then supplied that to some friends overseas, would that be violating munitions exporting if crypto was still covered?
    - colechristensen 12y ago
      Essentially, yes. A well educated person with the motivation and no cooperation from existing tech is very much capable of making the state department rather unhappy by exporting their own creation.
      - shard972 12y ago
        Well I suppose thats what we live for, to keep the state department happy.
  - judk 12y ago
    The Afghan Taliban and Saddam Hussein were armed by the USA. "Ally" and "Enemy" are transient labels. Cryptography is far more like body armor than it is like a gun.
    - yardie 12y ago
      The "Taliban" were never armed by the US. There were some members who were US allies during the Soviet-Afghan war. Just like they are some members of the Northern Alliance, US ally during the Afghan campaign, that were allies of the Soviet Union. In the end one war ended and groups broke up. Then the next war came and alliances had changed.
      - pjakma 12y ago
        The US funnelled hundreds of millions of $ through Pakistan to help fund the Mujahideen in Afghanistan. The CIA also provided direct support, in training and weapons, etc. https://en.wikipedia.org/wiki/Operation_Cyclone https://en.wikipedia.org/wiki/Operation_Cyclone Here's an Afghan with a Stinger missile (and there are lots of similar photos), not sold on the open market then, could realistically only have been acquired in bulk with US government assistance: http://tkfiles.storage.msn.com/y1pUt0liKawcr-ryBplDmzAGeFbxGpv3kgnqKuP6w2HdvM_snddyLIwB-FYJ5BkDWn4Fnr4buch5q8 http://tkfiles.storage.msn.com/y1pUt0liKawcr-ryBplDmzAGeFbxG...
      - arca_vorago 12y ago
        The names may have changed but the people didn't. We funded Gulbuddin Hekmatyar, and provided numerous FIM-92 stingers which after the war was over turned into the buyback fiasco, where many of these stingers were never recovered. Not to mention the third-party plausible denability effect, through which arms may not have passed directly to "Muj" or Taliban, but were supplied by the US. So to say the "Taliban" were never armed is completely factually incorrect, both in relevance to the Soviet war and the current one. If you want to learn more about the US involvement as the number one arms dealer in the word, the revised Shadow Factory book is out and worth the long read.
        12y ago
- colechristensen 12y ago
  Few things are more valuable in war than the secrecy of long distance communications. Though we haven't been at a conflict which posed any credible threat for the better part of a century, holding on to technological advantages when they're fresh is in our best interest and in the best interest of the American Peace we have going.
  - VMG 12y ago
    Computer technology alone is extremely valuable, would you be OK with restricting the export of that?
    - colechristensen 12y ago
      It's fairly unfortunate that a majority of computer technology is imported from foreign manufacturers for many reasons, but export control isn't really one of them. Supercomputers, yes ... general components... not particularly. In a lot of ways 'modern' computer technology isn't all that essential. It certainly isn't present in a whole lot of our military hardware because of realities of acquiring and maintaining such hardware _and_ the lack of an exponential increase of computing needs to match capabilities. In fewer words, computer technology is valuable, but not extremely so. Restricting the flow of anything remotely related to consumer computer tech wouldn't have much benefit, even if it were possible considering most of it is made in Asia.
      - VMG 12y ago
        Then just focus on basic computer technology. Restricting the export of semiconductors in the early 60s could have created a significant advantage for the US, but would be absurd to support a decision like that. Military benefit alone is not enough to justify an export restriction, one has to consider the cost on society as a whole. The cost of restricting the export of cryptography is too large to justify.
      - jimktrains2 12y ago
        > Supercomputers, yes ... general components... not particularly. There isn't a terribly large difference anymore except for size and tuning.
VMG 12y ago
The kind of cryptography that lets people communicate securely? Belongs on the same list as physical objects that intended to pierce walls and flesh? I'd also like a more in-depth explanation.
- colechristensen 12y ago
  >The kind of cryptography that lets people communicate securely? I don't know of any other kinds of cryptography... >Belongs on the same list as physical objects that intended to pierce walls and flesh? War has a lot less to do with shooting people and a lot more to do with information than you seem to appreciate. The public algorithms are public and there is no need or usefulness in export restrictions now on things known worldwide (and the usefulness of such restrictions was gone for a considerable time before they were lifted).
  - VMG 12y ago
    War has a lot to do with all kinds of things, however optimizing your country for warfare imposes a high cost on civil life and the economy. You failed to justify the decision of restricting the export of cryptography and the associated costs of that.
    - 001sky 12y ago
      This seems a bit harsh, perhaps. Bletchley park was still in the minds of many people. It would have been conventional wisdom to keep this stuff away from "bad guys". Recall, gps was spoofed at this stage as well for civilian purposes. The other issue--although perhaps unsaid--is that ultimately this may have hastened tactics to make HW unsecure, and to collect undisclosed/zero day expoits in widespread SW and other things that could compromise a comms system that was perceived to be secure.
      - TeMPOraL 12y ago
        Side-note: nice easter egg on Google when you search for "Bletchey park". Look at the "knowledge graph" result on the right.
deleted 12y ago
[deleted]
exelius 12y ago
It kind of made sense during the pre-Internet Cold War days when the only people with use for strong cryptography were nations and their militaries. These days it's just silly.

gioele 12y ago

We should remember that DJB was a key person in making cryptography fully legal in the US. «The State Department was unsympathetic to Bernstein's situation and told Bernstein he would need a license to be an arms dealer before he could simply post the text of his encryption program on the Internet. They also told him that they would deny him an export license if he actually applied for one, because his technology was too secure. The Electronic Frontier Foundation pulled together a top-notch legal team and sued the United States government on behalf of Dan Bernstein. The court ruled, for the first time ever, that written software code is speech protected by the First Amendment. The court further ruled that the export control laws on encryption violated Bernstein's First Amendment rights by prohibiting his constitutionally protected speech. As a result, the government changed its export regulations.» From https://www.eff.org/about/history https://www.eff.org/about/history http://cr.yp.to/export/status.html http://cr.yp.to/export/status.html http://en.wikipedia.org/wiki/Bernstein_v._United_States http://en.wikipedia.org/wiki/Bernstein_v._United_States

001sky 12y ago
Decided: December 9, 1996
interesting_guy 12y ago
Berenstain Bear
uuid_to_string 12y ago
So who should we entrust with protecting our communications over the open Internet? The US defense contractor and the reclusive gentleman in the UK whose code (for whatever reasons) has a rather poor security record, or the math professor whose code (qmail, daemontools, djbdns, etc.) generally has an excellent security record? Who enforces better quality control? Does that matter? Or maybe we should be asking how much these men are paid? (As are the journalists and their readers.) We know from the statements of the US Steve that the UK Steve does not get paid much for his work. Maybe it's really not about the money? Nevermind. I'm sure the journalists have it right.

vishnugupta 12y ago

I believe (citation needed :-)) there was (is?) restriction on the maximum length of private key. This was arrived at based on the computing resources available with NSA so that they be able to break a cypher by brute force. There's a very interesting passage in the book "The Code Book" towards the end as to how the inventor of PGP was harassed by slapping him with charges under Arms Export Control Act[1]. Zimmermann's law [2] is also very relevant to be mentioned here. [1] http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_investigation http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_invest... [2] http://en.wikipedia.org/wiki/Phil_Zimmermann#Zimmerman.27s_Law http://en.wikipedia.org/wiki/Phil_Zimmermann#Zimmerman.27s_L...

trevelyan 12y ago
Yeah. I seem to remember the limit being 64-bit at the time, although maybe it was only 56-bit. Netscape used to have different download links for "American" and "International" users and put up a stern warning on the US link saying that international users couldn't grab it. So, of course, everyone just downloaded the American edition... :)
- pdw 12y ago
  The limit was 40 bit. DES was 56 bit and "international" implementations zeroed out 16 bits of the key to make it exportable.