It seems that there is some confusion WRT to the origin of this product. The encryption technology was developed in New Zealand. The application itself was developed on the Isle of Man (British Isles). As a result, the US gov't has had nothing to do with the product and therefore none of the "concerns" represented in the previous message have any merit. What was meant by use of "honey" is that if you pick a fight with a government official, they will be happy to fight back. If you complement them on their farsighted visionary non-meddling approach you get a very different response. Our experience has been that we get a reasonable response from the NZ government that does not restrict the security that our products offer nor in the way that we choose to do business. Jack -----Original Message----- From: John Young [SMTP:jya@pipeline.com] Sent: Tuesday, January 27, 1998 4:02 PM To: cypherpunks@toad.com Cc: Jack Oswald Subject: RE: Announcement: RPK InvisiMail released on 12 Jan, 1998 On "using honey not vinegar" rationale of RPK InvisiMail for obtaining crypto export licenses: Applied Cryptography, Bruce Schneier, 2nd Edition, pp. 215-16 Algorithms for Export Algorithms for export out of the United States must be approved by the U.S. government (actually, by the NSA--see Section 25.1) It is widely believed that these export-approved algorithms can be broken by the NSA. Although no one has admitted this on the record, these are some of the things the NSA is rumored to privately suggest to companies wishing to export their cryptographic products: - Leak a key bit once in a while, embedded in the ciphertext. - "Dumb down" the effective key to something in the 30-bit range. For example, while the algorithm might accept a 100-bit key, most of those keys might be equivalent. - Use a fixed IV, or encrypt a fixed header at the beginning of each encrypted message. This facilitates a known-plaintext attack. - Generate a few random bytes, encrypt them with the key, and then put both the plaintext and the ciphertext of those random bytes at the beginning of the encrypted message. This also facilitates a known-plaintext attack. NSA gets a copy of the source code, but the algorithm's details remain secret from everyone else. Certainly no one advertises any of these deliberate weaknesses, but beware if you buy a U.S. encryption product that has been approved for export. ----- Bruce added the last "beware" phrase to the 2nd edition.