From: Jeff Weinstein <jsw@netscape.com>
Date: Sat, 9 Dec 95 01:20:12 PST
To: cypherpunks@toad.com
Subject: Netscape announces position against GAK
Message-ID: <30C953EC.28BA@netscape.com>
MIME-Version: 1.0
Content-Type: text/plain


I've included below the official Netscape position against GAK.
This page is now available on our web site at the URL below.
I'm sorry that we were not able to get this out earlier in the
week, but we ran into some delays due to travel schedules (people
attending the NIST meeting), and some logistical problems due to large
changes on our web site.

  There is a link to this document on our home page,
http://home.netscape.com/, which gets accessed more than 1 million
times per day.

  I would appreciate it if people who forwarded parts of the
recent Netscape/GAK discussion to other forums would at least
send them the URL for this page.

	--Jeff

http://home.netscape.com/newsref/ref/encryption_export.html

>   NETSCAPE PRESENTS POLICY ON ENCRYPTION EXPORT TO KEY MEMBERS OF THE
>                      ADMINISTRATION AND CONGRESS
> 
> ----------------------------------------------------------------------
> 
> This week Netscape representatives attending a government presentation
> of the administration's proposed Key Escrow Policy for Export detailed
> the company's firm opposition to the proposed policy. Netscape is
> opposed to this type of proposal for a number of reasons including its
> failure to adequately address the issues of acceptability by foreign
> governments and corporations, significant personal privacy concerns,
> and the mandatory nature of tying the Exportable Key Size to the Key
> Escrow Proposal.
> 
> At present the proposed Key Escrow Policy for Export states that a
> U.S. Government-approved key escrow process must be used by U.S.
> software manufacturers if they wish to export commodity encryption
> products of a key length up to 64 bits. Currently, Netscape can only
> provide its non-U.S. customers with products containing a 40-bit key.
> It has been Netscape's experience that non-U.S. customers demand
> products as cryptographically strong as those that are available to
> U.S. customers (i.e., at least 128-bit key length). Hence, the current
> U.S. Government proposal is compelling software companies like
> Netscape to manufacture two different versions of its products - an
> inefficient and noncompetitive posture that does not meet the needs of
> the foreign markets.
> 
> Netscape believes that this division in the global marketplace is not
> compatible with the nature, structure, and history of the Internet and
> its users. In addition, the 64-bit key length size in the U.S.
> Government proposal is inadequate for security purposes; recent
> experience in the United States and other countries demonstrates that
> a 64-bit key can be compromised. Therefore, Netscape believes that the
> U.S. Government's proposal does not support the needs of industry.
> 
> In particular:
> 
>   1. The U.S. Government proposal imposes regulations that will not
>      scale up to the speed at which the information
>      technology/Internet software industry continues to develop. The
>      proposed process represents a regulatory burden that is not
>      consistent with the decentralized and agile nature of the
>      IT/Internet business. The proposal puts at risk significant
>      economic stability not just for U.S.-based IT firms but for the
>      U.S. economy as a whole as every sector's growth is fueled by the
>      increasing availability and innovative use of information
>      products and services.
> 
>   2. The U.S. Government proposal would in effect result in the
>      mandatory use of these export-grade products within the United
>      States. The proposal includes a non-interoperability criteria
>      that would make it impossible for a non-escrowed software product
>      to talk to an escrowed software product. Thus, consumers inside
>      the United States would be forced to use a government-approved
>      key-escrow product if they value the ability to communicate with
>      others outside the United States.
> 
>   3. Corporate and individual rights to privacy are placed in question
>      by the current U.S. Government escrow proposal and process. This
>      is so because of the mandatory nature of the proposal resulting
>      from the key escrow requirement itself and the oversight role
>      government proposes to play in the accreditation process and
>      business practices of an escrow agent.
> 
> Netscape will continue to work with industry organizations, partners,
> and customers who are in similar opposition to the government's
> proposal to ensure that the current administration understands the
> unacceptability of this plan.
> 
> ----------------------------------------------------------------------
> 
>       Find out more about Netscape at info@netscape.com, or call
>                              415/528-2555.
>          Copyright (c) 1995 Netscape Communications Corporation

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.