> On Apr 18, Joshua E. Hill wrote
> > Purely from a crypto regulation standpoint, we were better off when
> > Linus was in Finland. If we ever do get strong crypto in the kernel,
> > Linus won't be able to manage the kernel anymore... (or he won't be able
> > to export it, or he will be a felon). As this is the case, I doubt that
> > real crypto will be in the official distribution of the kernel anytime in
> > the near future.
>
> Unless Linus does like Dan Bernstein and sues the federal government. Of course,
> that could take a while. [Then again, maybe he could join in on the current
> suit...]
Lawyers aren't normally free, unlike linux itself.
I think Sun gets away because they have an offical exemption since it is
used for authentication (one of the exportable categories). They would
have to apply for this and pay $$$ to lawyers to shepherd it through.
The Apache http server (without SSL!) was declared non-exportable. So
don't think Linux is safe just because you think it has nothing that
would cause a problem.
IANAL, but...
Most things like Linux itself, and crypto "hooks" would not survive a
court challenge by the government wishing to restrict things, but it could
be very annoying until the case was resolved. It may also be why they
have never brought a case against anyone (but threatened Phil Zimmerman).
There is a difference between something being legal, and something being
against an invalid law which would eventually be thrown out - Judge Patel
in the Bernstein decision indicated that source code was first ammendment
free speech and that the Government could not restrict such expression
unless there were severe controls (time limit to decide, government must
prove need and pay court costs to defend) on the mechanism. But that was
ITAR, and before the ink was dry, EAR appeared.
Please check out:
www.crypto.org
www.crypto.com
www.epic.org/crypto
www.cdt.org/crypto
Especially if you are in the US. There are links for both e-mail and
other things.
tz@execpc.com
finger tz@execpc.com for PGP key