On Sat, 16 Sep 2000, Roger Nordin wrote:
> Hello Michael
> On 16-Sep-00, you wrote:
>
> >> The real difference is that the international version
> >> makes 72 bits of the decryption key available in the
> >> header, effectively reducing the encryption level to
> >> 56 bits. Didn't anyone ever told you that?
This is not quite correct - see below.
> > I've never heard of that with Miami. Are you sure you're
> > not confusing Miami with how IE and Netscape do it ???
>
> Well, I don't think Netscape and Microsoft did that unless they were forced
> to do it by US authorities, due to legal reasons. Why would they cripple
> their products, unless they previously were forced to do it. As soon as the
> US Laws were changed, Microsoft immediately issued the full 128-bit high
> encryption worldwide. Thus, I don't expect Miami would be different. Do
> have any facts contradicting this to convince me with?
You could try getting *your* facts straight first. :-)
What you're referring to is the "crippling" of RC2 and RC4 to comply with
US export laws. These ciphers have fixed 128-bit keys, so to comply with
the *40-bit* limit, "export" versions were created with 88 bits of the key
set to a known constant. Meanwhile noncrippled versions were available to
residents of the US and Canada that swore not to export the code, etc.
The different versions are actually treated as separate ciphers for SSL
purposes, e.g. "ARCTWO-CBC-MD5" (128 bits) vs. "EXP-ARCTWO-CBC-MD5" (40
bits).
The first relaxation of the US export rules increased the allowable
"export grade" key size to 56 bits, mainly to make single-DES a legally
exportable cipher. AFAIK nobody ever created 56-bit versions of RC2 or
RC4 for the interim relaxation.
More recently, the export restrictions were dropped altogether, although
it's still necessary to obtain an export license for the product. This is
still a nuisance for a small developer, but no problem for large companies
like Microsoft or Netscape.
None of the above has *ever* had any direct impact on Amiga SSL
implementations. The reason is simply that Amiga software has the option
of originating outside the US and Canada, which is not an option for
Microsoft and Netscape. However, Amiga SSL implementations have suffered
from *other* limitations, not directly due to US regulations, but rather
due to licensing issues. These issues arise in three cases:
1) RC4 (and perhaps its clone ARCFOUR) is protected as a trade secret in
the US and Canada. Outside those countries, it's legally usable. The
normal licensing procedure for it is prohibitively expensive for small
developers, so it's not enabled in the US version of MiamiSSL. However,
it can be enabled via a patching program by users who believe they have a
legal right to use it.
2) IDEA is patented in Europe, and thus has never been allowed by default
in the international MiamiSSL. At one time, it was believed to be
US-legal and was enabled in earlier US versions, but it turned out to be
patented in the US as well so that was changed. However, it can be
enabled by a user patch in both cases, and a legitimate license for
personal use can be purchased online for only $15 US. It's actually
fairly rare for IDEA to be the only usable cipher, though.
3) RSA was patented in the US, but was legally usable for noncommercial
purposes (including shareware) provided that the specific free
implementation called RSAref was used. Outside the US and Canada, other
implementations could be used, and there was also no way to use RSAref
*outside* the US/Canada due to export restrictions. This led to two
implementations of the same cipher (PGP employed the same kludge), with
the "international" version being somewhat faster and not limited to
1024-bit keys as with RSAref. The most common cause of trouble with
RSAref is misconfigured SSH servers that require 1152-bit RSA keys for no
good reason, although a few HTTPS servers are starting to want longer RSA
keys.
The whole RSA picture changed 4 days ago with the expiration of the RSA
patent. It's now perfectly legal to use the "international" RSA
implementation in the US and Canada, and the only remaining legal
difference between the US and international versions concerns ARCFOUR.
Fred Wright
--
To unsubscribe send "unsubscribe miami-talk-ml" to
"[EMAIL PROTECTED]". For help on list commands send "help" to
"[EMAIL PROTECTED]".
