-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote:

I'm afraid my source is "Read it on the net and was surprised to hear it". My assumption is that the limit is for software that implements both signature and verification, since ITAR doesn't ban export of pure-authentication software.

Is the State Dept doc on the net? It would be nice to have something saying there are well-defined rules that they agree to follow, unreasonable and unconstitutional though they may be.

I'm still skeptical that such a restriction (1024-bit signatures) exists. If I recall, I originally found the State Dept. doc on the EFF site under a heading of CJ Export kit or something similar. I don't know if it is still there but it was out of date anyway as the contact in it had retired. You can probably contact the DoS and have them mail you one (as I did): Attn: Sam Capino U.S. Department of State Office of Defense Trade Controls PM/DTC Room 200 1700 N. Lynn Street Arlington, VA 22209-3113 Voice: 703-875-7396 Fax: 703-875-6647 The procedure is 5 pages and titled "Procedure for Submitting a Commodity Jurisdiction Request for a Mass Market Software Product that contains Encryption" When using RC2 and/or RC4, you have to request a separate test vector sheet titled "Supplemental Form for Mass Market Software Expedited Review" for each CJ request. Kent P.S. Does anyone know how to turn off this Gratis auto-signing service? I keep getting double posts when replying directly to the list via Netscape to hks.lists.cypherpunks. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMi8L4SoZzwIn1bdtAQF8PQGAl4952bwt/PJofD21qR+sAF0jStgUs76I NY9sfnXFcNHrFdgs6eEXHZ/lv3cstnnt =W0Ug -----END PGP SIGNATURE-----