Steve Bellovin writes: It is dangerously naive to label this success the ``last nail for US crypto export policy''. Everyone concerned with this issue, from the NSA to the FBI to anyone who wants to use crypto, understands this and accepts it. 40-bit keys are good for protection against casual snooping, and nothing more -- and no one is going to claim that you need supercomputers to crack them. In fact, I assert that the U.S. government is *happy* about these results -- because it's going to push folks towards wanting stronger crypto for export. The only problem, of course, is the terms under which such code can be exported... I'll go further -- in my opinion, the only reason the government doesn't want DES to fall just yet is that alternatives aren't ready. That is, the banks and financial institutions, and for that matter the government agencies, have not converted to 3DES or Clipper or what have you, and can't do so on short notice; the commercial products they need just aren't ready yet. No one wants to risk a loss of confidence in the financial system. Two years from now, though, when some key escrow products are ready, it may be a different story. Steve is absolutely right on the money, particularly about the likely happiness on the government side. The true explanation of the current effort is a testimony to the strategic skill of the regulators, but it is not as represented aloud. Export controls are meaningless without domestic use restrictions and domestic use restrictions will never pass the test of the First Amendment. Therefore, in an effort to obtain what cannot be obtained politically, this administration makes the following ploy: (1) Withhold from American companies the wherewithal to compete internationally by crippling the products they may export; (2) Offer to those companies that will include the functional equivalent of domestic use restrictions in their products a competitive advantage that could never otherwise withstand any fairness test; (3) Declare the resulting imposition of domestic use controls to be the "voice of the marketplace" and "voluntary." This is as shameful as saying that a rape victim was "asking for it." --dan