From: Paul Robichaux <paul@ljl.COM>
Date: Tue, 21 May 1996 03:46:03 +0800
To: cypherpunks@toad.com
Subject: Re: Interactive Week exclusive - White House to launch "ClipperIII"
In-Reply-To: <adc3f6c107021004c0c4@[205.199.118.202]>
Message-ID: <v03006e02adc61cfbefc5@[206.151.234.118]>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="Boundary..3941.1071713578.multipart/signed"

--Boundary..3941.1071713578.multipart/signed
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

>1. Will there be pressures put on the browser companies (Netscape,
>Microsoft, etc.) and the e-mail companies (Qualcomm, Microsoft, Claris,
>Lotus, etc.) to produce a "world version" that meets export standards with
>a single shrink-wrapped package?

Qualcomm has elected not to directly support PGP in the past, and it would
appear that NSA & State have broadly construed the ITAR sections on crypto
capability to mean that apps which can plug in crypto modules are
themselves not exportable (cf. Kerberos bones and the whole rationale
behind the MS CryptoAPI.)

However, Eudora 3.0 includes a plugin architecture for translators. These
translators can be used in a variety of ways, including for message
compression, foreign-language translation, and signatures. In fact, one of
the sample "translators" provided provides a "sign with PGP" icon in the
message composition window. Click it, put in your passphrase, and off you
go-- much easier than any of the existing solutions.

The plugin technology is such that it would be easy to write signature &
encryption plugins to use your choice of technology: Fortezza, Entrust,
PGP, IPG, or whatever. In fact, you might see Fortezza and Entrust plugins
later this summer :)

Several 'punks have speculated in the past about whether a general-purpose
plugin architecture that could be used for crypto would subject the product
to ITAR. Since I very seriously doubt Qualcomm would design & ship this
capability without finding out whether such an architecture would render
their product unexportable, my assumption is that (at least for now) there
is no world version requirement-- but vendors still have to face the
hassles of keeping, selling, and maintaining two separate versions. Ask
Netscape how much fun _that_ is.

-Paul


--
Paul Robichaux                    LJL Enterprises, Inc.
paul@ljl.com                      Be a cryptography user. Ask me how.



--Boundary..3941.1071713578.multipart/signed
Content-Type: application/octet-stream; name="pgp00002.pgp"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="pgp00002.pgp"
Content-Description: "PGP signature"

LS0tLS1CRUdJTiBQR1AgTUVTU0FHRS0tLS0tClZlcnNpb246IDIuNi4yCgpp
UUNWQXdVQU1hQnU0UncxMVhkMzBmU3RBUUczTkFRQWlFVTFzQjNmdTBLK2c5
eXVpRFlla281OUNVVFNDRTY0CjFtWGpOU21oNlFEUStSeU5STHlDYkZ5d2Zu
bGZtNnlBNDRVci9ZVmQ5Q1ZJZG9CemNDVW9FamFKd0UxdU9VMFMKR2MxN04x
V2c2VFo0YUlBR1lNK1U3M202WjFaWUFPUDd5eEZocXRYeXhsVnB5b0FiU1Ur
cFE2UzVsdit0SDVQNApQUW9wdlZjbVg2MD0KPUpDSVEKLS0tLS1FTkQgUEdQ
IE1FU1NBR0UtLS0tLQo=
--Boundary..3941.1071713578.multipart/signed--