I know about the ban on exporting encryption that uses a 40bit or larger key. If you would use PGP, I'd recommend one of the completely open sourced ones, not the commerical ones.
Bak - Thu Jan 20, 2005 12:48 am
Post subject:
"Cracking" public key cryptography involves being able to factor large numbers(on the order of 2^128 for 128 bit encryption) into their prime factors(which these numbers each only have two of these factors). Factoring is not an easy problem in mathamatics, hence the security of RSA, PGP, and similar systems. If it was broken, it would probably be broken by a mathematician rather than a government agency (unless he or she is working for a government agency).
The ban on non-USA (and possibly their allies) to use encryption that uses a 40 bit or larger key is reassuring that they have not broken public key cryptography (I wonder where the US gets the authority to enforce this sort of law?). If I'm not wrong, I believe it took a distributed network of computers about two years to break 96 (or was it 128?) bit encryption using modern factoring methods, so even if the FBI or NSA has some super computer that was 10000 times faster than a distributed network, increasing the key by 128 bits makes the problem 2^128 times harder.
Dr Brain - Thu Jan 20, 2005 7:25 am
Post subject:
The NSA is the biggest employer of mathematicians in the world. So, obviously, if the NSA broke an encryption, it would have been done by a mathematician.
Gravitron - Thu Jan 20, 2005 10:41 am
Post subject:
www.distributed.net
Were good days doing the RC5 project back at INF.
Mr Ekted - Thu Jan 20, 2005 11:08 am
Post subject:
Yes, the laws for encryption in the US are really retarded. It is illegal for me to download most freely available encryption source code, embed it into my own application, and release it online without notifying--and in most cases getting permission from--the NSA. This applies to private key >= 56 bits or public key (symmetric) >= 128 bits (when last I looked). The laws are very poorly worded, making it difficult to tell if you need to notify or apply, if your software is considered commercial or mass-market, etc. In some cases you must submit your encryption source code to them for approval.
Do they really think this prevents terrorists from using any encryption they want? All it does is hurts innovation and suppresses the 1st Amendment.
CypherJF - Thu Jan 20, 2005 11:49 am
Post subject:
I don't think the original intent of the law was to surpress the rights of the developers, and innovators. Rather, more than likely, enacted to help protect the state by having archival of possible encryption routines at their disposal. Though, I have to admit, more recently legislation has begun to irritating such as new legislation before the california house of legislature providing for 1 year jailtime, and/or 2k$ fine for developing and/or distributing peer-to-peer applications. Don't even get me started on it.