NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/sci/crypt/6553

Text File | 1993-01-08 | 3.7 KB | 87 lines

Newsgroups: sci.crypt
Path: sparky!uunet!uunet.ca!rose!usenet
From: [e-mail] (robert heuman)
Subject: RSAREF and RIPEM
Organization: Rose Media Inc, Toronto, Ontario.
Date: Fri, 8 Jan 1993 21:46:18 GMT
Message-ID: <[e-mail]>
Sender: [e-mail] (Usenet Gateway)
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)
Lines: 75


Date Entered: 01-08-93 16:39
[e-mail] (David Sternlight) writes, in
Message-ID: <[e-mail]>

1.

S(> It's troubling because it would permit any old provocateur to post
S(> restricted information on a bulletin board and then have it claimed
S(> that it was then exportable. Given the international nature of
S(> such bulletin boards, the provocateur could be someone outside
S(> the U.S. and thus beyond the reach of the law himself. That
S(> would vitiate elementary safeguards for those protections
S(> we might agree are legitimate.

David, in a non-inflamatory way, if the "provocateur" were outside the
US, the posting would be from outside the US and the 'export' would
have already been 'exported' in the past or have originated outside
the US.

Even if it were restricted under US law, it might not be under the
law of the country of origin or the country from which it was posted
(which might not be the same). In fact, it might NOT be illegal to
import it into the US (just to export or re-export it).

Then the provocation would be against the second 'exporter'. Is this
how I am to understand the above?

2.

S(> A couple of examples:
S(> Lotus Notes, which uses RSA, is not exportable though it may be bought
S(> at many software stores, as far as I know.
S(>
S(> RSA has to sell special versions of its software with restricted
S(> key lengths overseas.

In this case, I must take the position that in the case of a Non-US
Multinational corporation, I would never then approve the use or
purchase of Lotus Notes.  I cannot afford to put my US competitors at
an advantageous position by letting them use better protection than I
can use.  After all, if they were to engage in industrial espionage
against me, they would then have an 'unfair' advantage if I
retaliated. Result would be my use of a different product, or a
secondary encryption legal where I am, such as PGP.  Is this a
reasonable position to take (I believe so), and how does it help Lotus
Corporation?

NOTE: the issue of industrial espionage and its legality is NOT a
discussion point.  It does occur - it will continue to occur - and
that is one of the reasons corporations protect data.

NOTE: Nor is it an admissible arguement in a court of law in many
countries to state that 'I knew the program had compromised protection
(to meet required US Law) but used it anyway', when someones' privacy has
been violated.  Just as in the US, if you know its dangerous, but use it,
and someone else gets hurt, when you could have used something better that
you knew of, you have NOT mitigated damages and could be liable.

For these reasons, I cound NOT authorize the purchase of any product with
a 40 bit limit imposed by the US on non-US/Canada sales, if outside the
US/Canada, and if I knew that that limit was both not imposed and not used
on the US/Canada version.  I could be violating MY COUNTRY's LAWS by
making such a purchase and then using the product!


I agree that the flames should be kept to a minimum.  The positions
taken are as a deliberate devil's advocate, and are not necessarily the
positions I would take in reality.


R.S. (Bob) Heuman <[e-mail]>
---
   RoseReader 1.70 P001886: Twice as human as anyone else? my opinions are my own
   RoseMail 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285