[112012] in cryptography@c2.net mail archive
Re: Question on export issues
daemon@ATHENA.MIT.EDU (=?UTF-8?Q?Ivan_Krsti=C4=87?=)
Mon Dec 31 10:59:07 2007
Cc: "Alan" <alan@clueserver.org>,
cryptography@metzdowd.com
From: =?UTF-8?Q?Ivan_Krsti=C4=87?= <krstic@solarsail.hcs.harvard.edu>
To: dan@geer.org
In-Reply-To: <20071230050636.0590033C94@absinthe.tinho.net>
Date: Sun, 30 Dec 2007 18:48:13 -0500
On Dec 30, 2007, at 12:06 AM, dan@geer.org wrote:
> never be permitted to export to the embargoed country
> list (Cuba, Iran, Sudan, Syria, North Korea, and Libya).
Not Libya. See 15 C.F.R =C2=A7740Spir[0], country group E: Cuba, Iran, =20=
North Korea, Sudan, Syria.
Interestingly, 15 C.F.R. =C2=A7746.8[1] also lists Rwanda: "an embargo =20=
applies to the sale or supply to Rwanda of arms and related mat=C3=A9riel =
=20
of all types and regardless of origin, including weapons and =20
ammunition." I am not a lawyer, and cannot tell whether this applies =20
to encryption.
We've recently had to jump through the BIS crypto export hoops at =20
OLPC. Our systems both ship with crypto built-in and, due to their =20
Fedora underpinnings, allow end-user installation of various crypto =20
libraries -- all open-source -- through our servers. It was a =20
nightmare; the regulations and paperwork appear to be designed for the =20=
use case of individual applications that utilize a handful of =20
primitives and attempt to keep the user from examining or modifying =20
the utilized crypto. Trying to fit a Linux distribution into this =20
model proved, er, challenging. (We also found that projects that we =20
expected would know the drill cold, such as Fedora and Mozilla, were =20
actually not very familiar with the processes involved.)
Cheers,
Ivan.
[0] http://www.access.gpo.gov/bis/ear/pdf/740spir.pdf
[1] http://www.access.gpo.gov/bis/ear/pdf/746.pdf
--
Ivan Krsti=C4=87 <krstic@solarsail.hcs.harvard.edu> | http://radian.org
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
