From: RHS Linux User <jthomas@gateway.webwon.com>
Date: Tue, 4 Jun 1996 04:55:14 +0800
To: cypherpunks@toad.com
Subject: Re: Java Crypto API questions
In-Reply-To: <31B2ADA5.577D@netscape.com>
Message-ID: <Pine.LNX.3.91.960603111342.11161A-100000@gateway.webwon.com>
MIME-Version: 1.0
Content-Type: text/plain




On Mon, 3 Jun 1996, Jeff Weinstein wrote:

> Andrew Loewenstern wrote:
> > 
> > Sun can export the signature though.  The vendor already has the package,
> > they just need the sig/cert...
> 
>   Not likely.  Sun will probably be required to agree not to do this
> as a condition of exporting software with "pluggable crypto".  Software
> with hooks for crypto functions is treated the same as the actual crypto
> as far as the ITAR is concerned.

When Microsoft announced their crypto API, they also announced that their 
signatures on crypto modules would be export-restricted.  According to 
e-mail I received from a Microsoft employee on the project, the act of 
signing was considered a "defense service" under ITAR, so exporting the 
signature would somehow be performing defense services for foreign 
persons.  It makes slightly less sense to me than the rest of the crypto 
export restrictions do, but I guess that's the deal that Microsoft worked 
out with the Feds in order to be allowed to do a crypto API at all.

Joe