NSA and the NCSA/Apache web servers
I was flipping through the Apache http Server Project's web site <http://www.apache.org/> when I came across the following note: Note: We were informed by NCSA that the NSA (The US National Security Agency - yes, the folks who in 1994 said "we're only 10 years behind schedule") considered the hooks to encryption in NCSA's httpd to be in violation of the munitions export law, thereby making its distribution to foreign sites illegal. For various reasons, we decided to remove the -DPEM_AUTH code completely. This was followed by a pointer to http://www.apache.org/nopgp.html from which the following text was taken: On May 17th, 1995, we were asked by a representative of NCSA to remove any copies of NCSA httpd prior to 1.4.1 from our web site. They were mandated by the NSA to inform us that redistribution of pre-1.4.1 code violated the same laws that make distributing Phill Zimmerman's PGP package to other countries illegal. There was no encryption in NCSA's httpd, only hooks to publicly available libraries of PEM code. By the NSA's rules, even hooks to this type of application is illegal. Wow -- hooks to encryption are unexportable -- now THAT's bullshit. Sheesh. -Amir /\ Set the controls for the heart of the sun. -Pink Floyd ______/ \ ___________ __ __ _ _ _ _ . . . axon@neuron.net \ / \/ For PGP 2.6 key send mail with subject: SEND PGPKEY
"Amir Y. Rosenblatt" <axon@neuron.net> wrote: Wow -- hooks to encryption are unexportable -- now THAT's bullshit. Sheesh. A few yuears ago I asked Matt Blaze if he would publish CFS with the sryptography removed, and he told me that AT&T's lawyers also believed this to be true. (So, of course, his answer was "No".) The hooks are as important as the crypto code. Interestingly though, Kerberos made it to Australia (Bond University I think) legally. Greg Rose INTERNET: greg_rose@sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 French's Forest co-mod sci.crypt.research NSW 2086 Australia. USENIX Director.
On Fri, 28 Jul 1995, Greg ROSE wrote:
A few yuears ago I asked Matt Blaze if he would publish CFS with the sryptography removed, and he told me that AT&T's lawyers also believed this to be true. (So, of course, his answer was "No".) The hooks are as important as the crypto code.
Interestingly though, Kerberos made it to Australia (Bond University I think) legally.
I was the person who put the encryption back into that version of kerberos (which is now called eBones). They removed all encryption calls. They had actually pulled out all calls to the des routines, so we had a 'working' authentication system that encrypted nothing. This version was called Bones (they ran a program called parania over Kerberos, and that left Bones :-). When I left, we had Kerberos working but I had not tested against 'true' kerberos. I belive it has been fixed by 'those that have followed' and now fully interoperates with MIT kerberos v4. So the 'international' version of kerberos is fully legal. BTW I wrote libdes (my DES library) as part of this work. Luckily I have escaped from Kerberos/eBones when I left Bond Uni but my nights are still haunted with memories of trying to follow the code :-). eric (who is having far more fun putting an SSL package together :-) -- Eric Young | Signature removed since it was generating AARNet: eay@mincom.oz.au | more followups that the message contents :-)
"Amir Y. Rosenblatt" <axon@neuron.net> wrote: Wow -- hooks to encryption are unexportable -- now THAT's bullshit. Sheesh.
A few yuears ago I asked Matt Blaze if he would publish CFS with the sryptography removed, and he told me that AT&T's lawyers also believed this to be true. (So, of course, his answer was "No".) The hooks are as important as the crypto code.
Interestingly though, Kerberos made it to Australia (Bond University I think) legally.
Actually, neither hooks nor encryption are unexportable, you just need a license to export them. I got a license to export an RSA encryption scheme and a general purpose hook into encryption for integrity toolkit. It took a few months and was not very difficult, but you have to apply. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236
On Jul 28, 12:18pm, Dr. Frederick B. Cohen wrote:
Subject: Re: NSA and the NCSA/Apache web servers
Actually, neither hooks nor encryption are unexportable, you just need a license to export them.
-- End of excerpt from Dr. Frederick B. Cohen
I hope I'm not alone in wondering why on earth this is the case. Ok, exporting cryptography from the USA is restricted, and highly controversial. I think there has been something on this one already. But what is it, in the legal wibble, that make _hooks_ to cryptography restricted. How have they worded things to make this the case. The hooks are of course completely useless in and of themselves. You can only do anything useful with them if you have the matching crypto package. Yours a confused Brit ... who doesn't have this problem ... yet!! -- ___________________________________________________________________ Andrew Meredith Senior Systems Engineer Tel: (direct) +44(0) 1793 545377 Network Engineering Tools Group Tel: (main) +44(0) 1793 541541 Motorola ECID Fax: +44(0) 1793 420915 16, Euroway, Blagrove Swindon SN5 8YQ, UK email: Andrew_Meredith@email.mot.com ___________________________________________________________________
On Fri, 28 Jul 1995, Andrew D Meredith wrote:
On Jul 28, 12:18pm, Dr. Frederick B. Cohen wrote:
Subject: Re: NSA and the NCSA/Apache web servers
Actually, neither hooks nor encryption are unexportable, you just need a license to export them.
The answer is to have some non-USA entity build shareable full fledged full powered crypto libraries and provide them for free for the rest of the world and for all machines. On Windoze DLL's or WIN32's would be needed, on PPC Mac's shared Lib's, on 68K Macs, an INIT that hooks itself via Gestalt, on Unix, shared LIB's, etc. I would also include routines for asking the user for a passphrase to prevent the running application from grabbing that password and providing weak security. Or a program running in the background that handles all the calls via IAC's or whatever... (like AppleEvents to PGP) All with full free source, etc and PGP compatibility, etc. Then the rest of us could write code that uses that library. Whoever wants crypto just downloads the library from whereever and uses it. In this case, would code written in the USA be exportable? Wei's library would have been perfect for something like this... too bad. :-( =================================================================93======= + ^ + | Ray Arachelian | Amerika: The land of the Freeh. | \-_ _-/ | \|/ |sunder@escape.com| Where day by day, yet another | \ -- / | <--+-->| | Constitutional right vanishes. |6 _\- -/_ 6| /|\ | Just Say | |----\ /---- | + v + | "No" to the NSA!| Jail the censor, not the author!| \/ | =======/---------------------------------------------------------VI------/ / I watched and weeped as the Exon bill passed, knowing that yet / / another freedom vanished before my eyes. How soon before we see/ /a full scale dictatorship in the name of decency? While the rest / /of_the_world_fights_FOR_freedom,_our_gov'ment_fights_our_freedom_/
...
Actually, neither hooks nor encryption are unexportable, you just need a license to export them. ...
I hope I'm not alone in wondering why on earth this is the case.
They don't want to encourage encryption if they can avoid it. It impairs their ability to gather intelligence.
Ok, exporting cryptography from the USA is restricted, and highly controversial. I think there has been something on this one already.
But what is it, in the legal wibble, that make _hooks_ to cryptography restricted. How have they worded things to make this the case.
Legal? What makes you think so? It hasn't made it to the courts yet because people in the US aren't willing to risk jail for over their right to do it. The only court case I am aware of was the RSA case and in that one, the courts ruled against the NSA - but in today's political and economic environment, people who do cryptography don't want to risk it.
The hooks are of course completely useless in and of themselves. You can only do anything useful with them if you have the matching crypto package.
Not really right. It's very easy to change a compression hook into an encryption hook using standard off-the-shelf shareware, public domain software, or commercial products.
Yours a confused Brit ... who doesn't have this problem ... yet!!
Don't bet on it. If you really try to export top-flight encryption technology in a big way, you may find that your government can be just as opressive as mine. -- -> See: Info-Sec Heaven using our New Super Secure World-Wide-Web Server -> Free: Test your system's security (scans deeper than SATAN or ISS!) ---------------------- both at URL: http://all.net ---------------------- -> Read: "Protection and Security on the Information Superhighway" John Wiley and Sons, 1995 ISBN 0-471-11389-1, 320 pp, $24.95 ------------------------------------------------------------------------- Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236
On Jul 28, 2:09pm, Dr. Frederick B. Cohen wrote:
Subject: Re: Hooks to Crypto> ...
Actually, neither hooks nor encryption are unexportable, you just need a license to export them. ...
I hope I'm not alone in wondering why on earth this is the case.
They don't want to encourage encryption if they can avoid it. It impairs their ability to gather intelligence.
I kind of meant "why they think they can" rather than "why they want to". One can't really help being aware these days what the US government (and indeed many others) are trying to do.
Legal? What makes you think so? It hasn't made it to the courts yet
Oh ... I see ... just like the rest of this stuff, only more so.
because people in the US aren't willing to risk jail for over their right to do it. The only court case I am aware of was the RSA case and in that one, the courts ruled against the NSA - but in today's political and economic environment, people who do cryptography don't want to risk it.
Judging by the PZ case, I can't say as I can really blame them. it would be better of course if they would go for it, but ...
The hooks are of course completely useless in and of themselves. You can only do anything useful with them if you have the matching crypto package.
Not really right. It's very easy to change a compression hook into an encryption hook using standard off-the-shelf shareware, public domain software, or commercial products.
I probably should have written "a crypto package" instead of "the matching crypto package". This would infer that anything that can cause information to be piped out to a package and then the result sucked back in would fall into this category. Hmmm map ^Xe :,$! /bin/sh -c 'pgp -feast 2>/dev/tty^V|^V|sleep 4'^M^L Everyone DELETE VI NOW !!! >;)
Yours a confused Brit ... who doesn't have this problem ... yet!!
Don't bet on it. If you really try to export top-flight encryption technology in a big way, you may find that your government can be just as opressive as mine.
Our lot tend to work in a different way to yours. Similar end result of course, but different approach. So when I said "yet". I was meaning that, at the moment, we have no laws specifically refering to Cryptography and it's export, but the approach I can see being taken would be: 1 - Find yourself a tenuous link with some Psycho-Baby-Killer group. 2 - Start a "This must be stopped" campain. 3 - Propose the "Internet Pornography Act" 4 - Shove it through before anyone can get together enough opposition to get it squashed. (and that would have to be a GREAT DEAL of opposition). That's how they did the "Criminal Justice Act" which breaks both European and International law in a great many places. That's how they'll do the "Internet Pornography Act". It'll be just loose enough to include just about anything they want it to.
-- End of excerpt from Dr. Frederick B. Cohen
Andy M
...
because people in the US aren't willing to risk jail for over their right to do it. The only court case I am aware of was the RSA case and in that one, the courts ruled against the NSA - but in today's political and economic environment, people who do cryptography don't want to risk it.
Judging by the PZ case, I can't say as I can really blame them. it would be better of course if they would go for it, but ...
In my case, I just opted to moving my crypto business outside the US. This is the real result of the crypto policy. The US is falling behind the rest of thew world in crypto R+D. For example, two good crypto packages for the Internet have been released in the last few months. I was engaged in a similar project in the late 80s but abandoned it because I couldn't export, so the market would not justify the work. Now it is owned by people in EC and Australia who are generous enough to allow those of us in the US to use them. Of course, I can't post them in info-sec heaven because even imported crypto software may not be exported, and I cannot adequately detect the difference between a foreign person using a US site to get the information and a legitimate US site getting the information for itself. In other words, the policy prevents US firms from having better Internet resources in the info-sec arena. ...
This would infer that anything that can cause information to be piped out to a package and then the result sucked back in would fall into this category.
Right - in other words, nothing can be exported if it produces output and takes input. The point is, they want a way to arrest people who are doing something they don't like. Philo Zimmerman would almost certainly win if they ever took him to court, but by harassing him in this more subtle way, they destroy the impact of PGP in the marketplace, get MIT to support an official (and perhaps customized for the NSA to have weak keys) version, and prevent others from following in Phil's footsteps. So the strategy works until some brave person risks enough top get past it. ...
1 - Find yourself a tenuous link with some Psycho-Baby-Killer group. 2 - Start a "This must be stopped" campain. 3 - Propose the "Internet Pornography Act" 4 - Shove it through before anyone can get together enough opposition to get it squashed. (and that would have to be a GREAT DEAL of opposition).
That's how they did the "Criminal Justice Act" which breaks both European and International law in a great many places. That's how they'll do the "Internet Pornography Act". It'll be just loose enough to include just about anything they want it to.
All true, but as the saying goes: Representative democracy is a terrible form of government, but every other form of government we know of is even worse. -- -> See: Info-Sec Heaven using our New Super Secure World-Wide-Web Server -> Free: Test your system's security (scans deeper than SATAN or ISS!) ---------------------- both at URL: http://all.net ---------------------- -> Read: "Protection and Security on the Information Superhighway" John Wiley and Sons, 1995 ISBN 0-471-11389-1, 320 pp, $24.95 ------------------------------------------------------------------------- Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236
On Fri, 28 Jul 1995, Dr. Frederick B. Cohen wrote:
Philo Zimmerman would almost certainly win if they ever took him to court, but by harassing him in this more subtle way, they destroy the impact of PGP in the marketplace, get MIT to support an official (and perhaps customized for the NSA to have weak keys) version,
I've personally pulled apart the innards of both MIT pgp 2.6.2 and the non-MIT pgp 2.6.2i in order to generate large primes and full RSA keys. There are no hacks in MIT pgp that cause it to generate weak keys. - Andy +-------------------------------------------------------------------------+ | Andrew Brown Internet <asb@nexor.co.uk> Telephone +44 115 952 0585 | | PGP (2048/9611055D): 69 AA EF 72 80 7A 63 3A C0 1F 9F 66 64 02 4C 88 | +-------------------------------------------------------------------------+
participants (7)
-
Amir Y. Rosenblatt -
Andrew D Meredith -
Andy Brown -
Eric Young -
fc＠all.net -
Greg_Rose＠sibelius.sydney.sterling.com -
Ray Arachelian