From: Bill Stewart <bill.stewart@pobox.com>
Date: Mon, 26 Jan 1998 15:09:27 +0800
To: RPK New Zealand Ltd <cypherpunks@cyberpass.net
Subject: Re: Announcement: RPK InvisiMail released on 12 Jan, 1998
Message-ID: <3.0.5.32.19980125184413.0086fd20@popd.ix.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain



I was amused to receive two mail messages back-to-back,
one from Peter Gutmann talking about New Zealand having one of the
strictest formal export controls in the world, and one from
RPK New Zealand talking about how their encryption product is
not export-controlled because it's from NZ, not the US,
and how their RPK Fast Public Key Encryptonite(tm) Engine
is the strongest crypto in the world.  Either they haven't
bothered asking for export permission, or they asked in such a way
that the export bureaucrats didn't notice it was crypto and
regulated by their crypto export preventers, or their crypto
somehow falls through the cracks, e.g. by using an algorithm with
public keys shorter than 512 bits (works for ECC, not RSA)
and private keys shorter than 40 bits (or 41 on a good day),
or perhaps passes the "snake oil test" for export permission.
I suppose it's possible that the NZ Export Bureaucrats have
lightened up since Peter's last dealings with them,
but it's not likely.

>--------------- The mail, referencing www.invisimail.com
>RPK New Zealand Ltd. in a joint venture with Virtually Online Ltd. 
>has released RPK InvisiMail, a standards-based e-mail security 
>application for use with Internet mail software (SMTP/POP3).  
>The product offers the strongest encryption available anywhere in 
>the world.  Since it was built outside the United States, 
>it is also available all over the world with strong encryption.  
>RPK InvisiMail is also the easiest product of its type
>to setup and use which makes it quite unique.

========= From Peter Gutmann's web page
This policy has resulted in New 
Zealand enjoying the dubious distinction of having the strictest export 
controls on earth, with everything ranging from crypto hardware down to 
software, library books, computer magazines, and journals being restricted 
from export.  It's not even possible for a university to publish academic 
research without prior permission from a government agency, and the 
requirements for obtaining this permission are structured to ensure that they 
can never be fulfilled.  You can find the information on:
 
  http://www.cs.auckland.ac.nz/~pgut001/policy/

==============================
				Thanks! 
					Bill
Bill Stewart, bill.stewart@pobox.com
PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639