| > How and when the changes in export laws will affect OSF/DCE
> DES encryption exports?
>
> Statement given seems to accept any export of DES based technology
> NOW (in DIGITAL products), and this gives us an WINDOW of OPPORTUNITY
> which is narrow, and we'd like to utilize it!
We don't want to leave you hanging, but we don't have a good answer yet.
Yes, the statement seems to give us the right to export DES based products
now. However, that permission is based on having a plan in place to
implement key recovery. We do not yet have such a plan, and are not yet
certain that we can make a plan. We have our best security minds
working on that now.
We're evaluating what all this means, but won't have an answer for probably
a couple more weeks. This change was a surprise to us, and we haven't
figured out all the consequences yet.
Beth Benoit
Software Engineering Manager
DCE for Windows NT and Windows 95
|
|
Beth,
Thanks for your update. I will add another memo, that might
interest folks communicating with customers about this and
similar topics.
-jari
------
Pvm: 03.02.1997 17:42 EET
L�hett�j�:Robert Rarog @DCC
RAROG.ROBERT@COPSS1A1@SOAREA@ALF
Osasto: DIGITAL TRADE
Puhelin: 427-2134 (202)898-2134
Vastaanottaja: Katso alla
Aihe: Key Recovery Plan Approval 1
On January 30, Digital became one of three companies to obtain U.S.
Government approval for a Key Recovery Plan. As a result, we will
be able to ship encryption products containing DES (or 56-bit RC4)
without Key Recovery to most customers outside of embargoed
countries without a U.S. export license for two years.
Up to now, Digital DES products have been approvable for export to
subsidiaries of U.S. firms and banks only, and then only after
onerous Department of State munitions licensing procedures. Now
such products can be shipped to most customers (exceptions:
proscribed end-users such as denied parties and proliferation
end-users).
Products eligible for shipment under this authorization are:
o Encryption for OpenVMS
o Roamabout wireless LAN adapters
o DCE privacy options.
NOTE: Product managers should contact Keith Melchers @dcc of the
Trade Organization for information on recordkeeping, coding and
product release procedures.
In addition, the Alta Vista Tunnels have been cleared for export at
DES-strength at such time that 56-bit versions of these products
are released.
The ability to ship DES-strength products without Key Recovery will
be renewed every six months until Jan 1, 1999, provided we meet our
Key Recovery milestones. However, our ability to support customers
who bought these products within the two-year period, including the
ability to provide upgrades not affecting key length and additional
licenses, will continue indefinitely.
While the other two companies to receive export approval for DES
products have not been identified by DOC, Trusted Information
Systems has announced that it is one. As IBM also has an
application pending, it may be the other, although there has been
no public announcement.
Regards,
Bob Rarog
|