Page 3People living outside the United States find it amusingand perplexing that U.S. law regulates the distribution ofstrong encryption. But anyone outside the United States caneasily obtain strong encryption. The source code for mostof the popular strong encryption algorithms is available fordownloading at no cost. Sites that provide the code, scat-tered around the world, are not subject to U.S. law.
Thus,export controls have little or no relevance outside theUnited States. At best, export controls are futile.Supporters of export controls argue that America is theonly source of high-quality strong encryption, becauseencryption algorithms developed elsewhere are inferior inrelative security to those originating in the UnitedStates.
A recent Commerce Department report states, "Ourinformation indicates that, on the whole, American encryp-tion is superior."
The report refers to a classifiedCommerce Department survey of 28 products released in 1994;
the analysis of non-U.S. cryptographic systems is inked outin publicly available copies, making it difficult to rebut.But the statement is hotly contested and, obviously,subject to independent analysis.
This paper shows that thetheory of the inferiority of non-U.S. crypto defies commonsense and ignores a number of strong encryption systemsdeveloped in other nations.A good cryptographer needs an in-depth understanding ofhigher level mathematics, some basic analytical talent, andexposure to the fundamentals of cryptographic history andcurrent techniques. Anyone with an interest in that body ofknowledge can have access to it. No geographic attributesignificantly influences the qualities necessary to be acryptographer or gives citizens of one nation any advantageover those of another.This paper shows that cryptographic products thatoriginate outside the United States are not inferior tothose created internally. The notion that overseas computerusers will not take the time to modify products to improvetheir security or seek out strong encryption from sourcesoutside the United States is ridiculous. In addition,strong encryption technology developed within the UnitedStates or outside of it readily spreads to other countriesin spite of export controls. Although some other countrieshave export controls (for example, New Zealand), many pre-sent no obstacle to the export of encryption products devel-oped there, and the remainder (such as Finland) have ineffect no controls at all.