Re[2]: VerSecure - "strong encryption" exportable from the U

[Stewart Baker]

     Actually, once the ability to generate the tokens is exported (and that's 
     what's been approved for the five countries), the US can't control the kind 
     of crypto that is activated.  The UK can.  It can  change policy and decide 
     to restrict what crypto is enabled.  But if commercial buyers think such a 
     change is likely, that's probably a reason for commercial buyers to be 
     interested in Versecure, not a reason to stay away.  
     
     Commercial users won't thumb their nose at UK law.  So if they bought 
     hardwired crypto they'll have to throw out anything that doesn't conform to 
     the new law unless they've got a flexible system like this.  
     
     Same thing is true in reverse for French users.  Why buy something that's 
     been permanently weakened to meet French law when you can get something 
     that's easily upgraded in place if French law changes?


______________________________ Reply Separator _________________________________
Subject: Re: VerSecure - "strong encryption" exportable from the US 
Author:  <ukcrypto@maillist.ox.ac.uk > at INTERNET
Date:    2/28/98 7:15 PM


Peter Wayner has a good article on this in today's online 
New York Times, which examines the pros and cons. 
     
The HP system is exportable only to countries approved by 
the USG, of which there are an initial five: UK, Germany, 
France, Denmark and Australia. Any new candidate
country must establish a "Security Domain Authority" (SDA) 
satisfactory to the USG.
     
Moreover, the token which provides access to the crypto is 
limited to one year before lapsing and must be annually 
renewed to permit adjustment to fit national policy. 
     
Critics of the system have pointed out that that token 
renewal would also allow the US or any other nation 
to easily impose a clampdown, and for that reason HP's 
system may be seen a "camel's nose in the tent" precursor
to tighter restrictions. And such a possibility requires that 
it be avoided -- and probably will be by the commercial 
market.
     
   http://www.nytimes.com
     
     
We've put a copy at:
     
   http://jya.com/hp-sda.htm