Welcome to Scribd, the world's digital library. Read, publish, and share books and documents. See more
Download
Standard view
Full view
of .
Look up keyword
Like this
5Activity
0 of .
Results for:
No results containing your search query
P. 1
The Myth of Superiority of American Encryption Products, Cato Briefing Paper

The Myth of Superiority of American Encryption Products, Cato Briefing Paper

Ratings: (0)|Views: 408|Likes:
Published by Cato Institute
Executive Summary

Encryption software and hardware use sophisticated mathematical algorithms to encipher a message so that only the intended recipient may read it. Fearing that criminals and terrorists will use encryption to evade authorities, the United States now restricts the export of encryption products with key lengths of more than 56 bits. The controls are futile, because strong encryption products are readily available overseas.



Foreign-made encryption products are as good as, or better than, U.S.-made products. U.S. cryptographers have no monopoly on the mathematical knowledge and methods used to create strong encryption. Powerful encryption symmetric-key technologies developed in other countries include IDEA and GOST. Researchers in New Zealand have developed very strong public-key encryption systems. As patents on strong algorithms of U.S. origin expire, researchers in other countries will gain additional opportunities to develop strong encryption technology based on those algorithms.
Executive Summary

Encryption software and hardware use sophisticated mathematical algorithms to encipher a message so that only the intended recipient may read it. Fearing that criminals and terrorists will use encryption to evade authorities, the United States now restricts the export of encryption products with key lengths of more than 56 bits. The controls are futile, because strong encryption products are readily available overseas.



Foreign-made encryption products are as good as, or better than, U.S.-made products. U.S. cryptographers have no monopoly on the mathematical knowledge and methods used to create strong encryption. Powerful encryption symmetric-key technologies developed in other countries include IDEA and GOST. Researchers in New Zealand have developed very strong public-key encryption systems. As patents on strong algorithms of U.S. origin expire, researchers in other countries will gain additional opportunities to develop strong encryption technology based on those algorithms.

More info:

Published by: Cato Institute on Mar 26, 2009
Copyright:Attribution Non-commercial

Availability:

Read on Scribd mobile: iPhone, iPad and Android.
download as PDF, TXT or read online from Scribd
See more
See less

04/04/2014

pdf

text

original

 
THE MYTH OF SUPERIORITY OFAMERICAN ENCRYPTION PRODUCTS
BY
H
ENRY
B. W
OLFE
Executive Summary
Encryption software and hardware use sophisticatedmathematical algorithms to encipher a message so that onlythe intended recipient may read it. Fearing that criminalsand terrorists will use encryption to evade authorities, theUnited States now restricts the export of encryption prod-ucts with key lengths of more than 56 bits. The controlsare futile, because strong encryption products are readilyavailable overseas.Foreign-made encryption products are as good as, orbetter than, U.S.-made products. U.S. cryptographers haveno monopoly on the mathematical knowledge and methods usedto create strong encryption. Powerful encryption symmetric-key technologies developed in other countries include IDEAand GOST. Researchers in New Zealand have developed verystrong public-key encryption systems. As patents on strongalgorithms of U.S. origin expire, researchers in other coun-tries will gain additional opportunities to develop strongencryption technology based on those algorithms.
No. 42 November 12, 1998
 
Cato Institute1000 Massachusetts Avenue, N.W.Washington, D.C. 20001(202) 842-0200
 
Page 2
THE MYTH OF SUPERIORITY OF AMERICAN ENCRYPTION PRODUCTS
by Henry B. WolfeEncryption software and hardware use sophisticatedmathematical algorithms to encipher a message so that onlythe intended recipient may read it. Encryption is the bestway to keep electronic messages private and secure. Ini-tially, the U.S. Department of State regulated encryptionexports as "munitions" under the International Trade in ArmsRegulations, promulgated under the Arms Export Control Actof 1976.
1
Executive Order 13026, issued by PresidentClinton in November 1996, moved the responsibility to theBureau of Export Administration, an agency of the U.S.Department of Commerce.
2
Today, U.S. regulation prohibitsthe export of many products that incorporate strongencryption. One important determinant of the strength of anencryption system is the length of the key to the cipher,measured in bits. Only hardware and software products witha key size of fewer than 56 bits have been approved forexport under a general license. The administration hasannounced that exports of products offering unlimited bitlength will be approved to subsidiaries of U.S. corporationsworldwide (except for those in the seven "terroristnations"), to health and insurance companies, and to on-linemerchants (in 45 countries). But restrictions remain onmany types of encryption products, especially those thatwould be used by noncommercial groups or individuals forend-to-end encryption of e-mail or other communications.Licensing requirements and export controls restrict thestrength--and thus the quality--of many types of encryptionproducts exported from the United States. Products able tomeet the licensing requirements are routinely reduced intheir overall security effectiveness and do not meet therequirements of the overseas market. Export controls areintended to keep sensitive technology out of the hands ofterrorists and countries hostile to the United States. Forexport controls to succeed, authorities recognize that thecontrolled technology must not be available from sourcesoutside the United States.
3
  ____________________________________________________________
Henry B. Wolfe has been an active computer professional for nearly 40 years. He has taught computer security at thegraduate level at the University of Otago in New Zealand for the past 15 years.
 
Page 3People living outside the United States find it amusingand perplexing that U.S. law regulates the distribution ofstrong encryption. But anyone outside the United States caneasily obtain strong encryption. The source code for mostof the popular strong encryption algorithms is available fordownloading at no cost. Sites that provide the code, scat-tered around the world, are not subject to U.S. law.
4
Thus,export controls have little or no relevance outside theUnited States. At best, export controls are futile.Supporters of export controls argue that America is theonly source of high-quality strong encryption, becauseencryption algorithms developed elsewhere are inferior inrelative security to those originating in the UnitedStates.
5
A recent Commerce Department report states, "Ourinformation indicates that, on the whole, American encryp-tion is superior."
6
The report refers to a classifiedCommerce Department survey of 28 products released in 1994;
7
the analysis of non-U.S. cryptographic systems is inked outin publicly available copies, making it difficult to rebut.But the statement is hotly contested and, obviously,subject to independent analysis.
8
This paper shows that thetheory of the inferiority of non-U.S. crypto defies commonsense and ignores a number of strong encryption systemsdeveloped in other nations.A good cryptographer needs an in-depth understanding ofhigher level mathematics, some basic analytical talent, andexposure to the fundamentals of cryptographic history andcurrent techniques. Anyone with an interest in that body ofknowledge can have access to it. No geographic attributesignificantly influences the qualities necessary to be acryptographer or gives citizens of one nation any advantageover those of another.This paper shows that cryptographic products thatoriginate outside the United States are not inferior tothose created internally. The notion that overseas computerusers will not take the time to modify products to improvetheir security or seek out strong encryption from sourcesoutside the United States is ridiculous. In addition,strong encryption technology developed within the UnitedStates or outside of it readily spreads to other countriesin spite of export controls. Although some other countrieshave export controls (for example, New Zealand), many pre-sent no obstacle to the export of encryption products devel-oped there, and the remainder (such as Finland) have ineffect no controls at all.
9

You're Reading a Free Preview

Download
scribd
/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->