3mo ago

TIL: Until the late 90s, it was illegal to export encryption software that used keys over 40 bits in size from the USA. This lead to a criminal investigations of the creator of PGP and others.

en.wikipedia.org

Export of cryptography from the United States - Wikipedia

The software was classed as munitions and one needed an arms dealer's license to publish it, including online. The creator of PGP published the full source code as a book, as these are covered under first amendment rights.

37 comments

Yes, that was indeed a very interesting story:
Zimmermann challenged these regulations in an imaginative way. In 1995, he published the entire source code of PGP in a hardback book, via MIT Press, which was distributed and sold widely. Anyone wishing to build their own copy of PGP could cut off the covers, separate the pages, and scan them using an OCR program (or conceivably enter it as a type-in program if OCR software was not available), creating a set of source code text files. One could then build the application using the freely available GNU Compiler Collection. PGP would thus be available anywhere in the world. The claimed principle was simple: export of munitions—guns, bombs, planes, and software—was (and remains) restricted; but the export of books is protected by the First Amendment. The question was never tested in court with respect to PGP. In cases addressing other encryption software, however, two federal appeals courts have established the rule that cryptographic software source code is speech protected by the First Amendment (the Ninth Circuit Court of Appeals in the Bernstein case and the Sixth Circuit Court of Appeals in the Junger case)...
(Source)
- Yep, we called them crypto wars
- Zimmerman flew, and Tyler knew!
Fun fact: They made encryption on Ham/GMRS radios illegal because they didn't want the average citizenry to have access to secure off-grid comms without government spyware on networks that they control.
Reject Smarphones, Return to Amateur Radios. Just modify some radios, add a raspberry pi to do enccyption on the voice before it gets transmitted.
THEY CANT ARREST US ALL! (seriously tho, I haven't heard of the FCC actually doing anything, unless you were jamming the airport radios or something crazy)
- It's illegal on licensed HAM channels, but legal on unlicensed channels like the 2.4 and 5Ghz ranges
  Don't ask me why the distinction still remains
  
  international treaties, for one. second because lack of encryption discourages commercial/non-hobbyist use. third because the spirit of Ham is for Hams to all listen and transmit to each other.
- I think FCC still takes it pretty seriously.
  just use Meshtastic/LoRa. you can use encryption and you don't need a Ham license. your output power is limited but I've heard of people getting 50+ miles of range for reception.
  specifically, for ham you're not allowed to obscure the meaning of your transmissions. this means no:
  symmetric cryptography
  numbers stations (one-time pad ciphers)
  communicating in codewords ("the Falcon has left the nest, over!"
  but you can use:
  compression
  commercial telegraph codes (e.g. 22415 = "Partly cloudy with a chance of showers"), as long as you're using a public codebook
  message authentication codes (to prevent forging messages)
  (arguably) asymmetric cryptography for signatures, identity challenge/response
  encrypted control messages for hobbyist satellites (special exemption)
  so authentication is possible, just not privacy.
- The primary reason is the FCC can't tell if the encrypted transmissions are commercial or otherwise illegal. The amateur bands would be full of high frequency trading brokerages, drug traffickers, and spies.
- ...they definitely can arrest a bunch of people. A better way would be to challenge it in court.
  Or you could use other protocols like LoRaWAN
- Encryption using IP over HAM is still illegal - you can't access Lemmy because it's an HTTPS site, because we live in the 21st century.
  
  Nothing stops anyone from running a webserver without ssl, there might be an instance that does it
You're referring to the Crypto Wars
https://en.wikipedia.org/wiki/Crypto_Wars
Darknet diaries has a great episode on it. Highly recommend.
https://darknetdiaries.com/episode/12/
- Thank you. I've watched a bunch of Darkness diaries (Usually ones that people on external sites say "this one is really good, you should watch it"), but I've found it hard to get into (the perils of a podcast's large backlog being compared to a highlight reel). I haven't watched this episode though, so I look forward to checking it out
  
  It was my first one. Highly recommend ^-
Related xkcd
- ”Thank god for crypto” That hits different now.
I had one of those t-shirts in the early 00s. Got it at a Goodwill and hung it on my wall for a while
- I got one in the late 1990s. I wore it on a few trips from the US to Europe and was happily never jailed.
Yep I remember the scary text the came with certain software threatening superjail if you sent the exe overseas
- Jail Pro.
- As some from outside of the US, I also remember you had to pinky promise you are in the US to download the good version of Mozilla.
The whole thing reads like this is weak encryption that doesn't actually work and that is what they wanted people to have for that false sense of security. That's wild
- I don't remember the details but I listened to a few podcasts on the topics and that what exactly how the hosts presented it
- I mean, it's not great, but it's pretty good
- You'll love to hear that Blu-ray's format protection creators tried making illegal publishing the hexagesimal number "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0". https://en.m.wikipedia.org/wiki/Illegal_number#Background.
  
  HD DVD, not Blu Ray, a competing format
An annoyance that came shortly after was that they were not allowed to ship the Java Runtime Environment / Development Kit with a javax.crypto library that allowed for algorithms stronger than DES (such as AES, Twofish, Blowfish, ...), or long passwords, iirc.
There was some way to download something extra (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files) and fiddle it in, but with regulation in the US, I think.
I was quite sad when I made one of my early programs based on that and it turned out to be useless to US citizens, and hard to use for everyone else. I think I made a bouncycastle-based version later, but it was basically a full rewrite.
Edit: I'm starting to remember more absurdities of the time: Even with the JCE, the best algorithm for symmetric encryption was 3DES, which was not a legal requirement, just laziness of Sun Microsystems. While it was somewhat safe, it was less than ideal and really slow.
- I made a bouncycastle-based version later
  I enjoy how nonsensical this must sound to people unfamiliar with Java. 🙃
  
  lol right, must sound like Treknobabble but for the 2000s. Heck, for kids these days, it's probably as gibberish as original Treknobabble.
  I bet distant future archaeologist, be they human or alien, will assemble the bits and pieces like this: Child worker programmers would work in these inflatable tiny castles on the soft floor with their laptops. That was the last attempt to revive feudalism. Why it didn't catch on to other office jobs remains lost in the past.
- Fun fact, Google pay and other "modern" payment processors still had to use 3DES until 2020 at least (might still do, I got out of the industry).
Not all heroes wear capes
- https://en.m.wikipedia.org/wiki/Bernstein_v._United_States
Alr how do I get this shirt?

37 comments