<nettime> RSA Down Under

[Robert Hettinga <rah@shipwright.com> (by way of tbyfield)]

     [this was originally sent To: <dcsb@ai.mit.edu>. though it's
     pretty long, there's some very interesting historical stuff
     about how various crypto policies do and don't determine what
     happens in the real world rather than, say, in the overheated
     manichaean ramblings of conspiratorialists. in particular, the
     discussion of the way the pretzel logic of US crypto policy is
     coming apart under scattered pressures--loopholes, financial
     industry lobbying, grass-roots efforts like distributed.net,
     "offshore" software development, various countries' skepticism
     about the recent Wassenaar Organization agreement, etc. also
     noteworthy is the point that the US govt's methods for dealing
     with cryptography--time-intensive, arbitrary review of each and
     every application to export a product--doesn't scale well. --tb] 

--- begin forwarded text

Date: Mon, 11 Jan 1999 14:53:25 -0500
To: "David Farber" <farber@cis.upenn.edu>
From: Vin McLellan <vin@shore.net>
Subject: RSA Down Under
Cc: e-commerc@www.ispo.cec.be
Sender: owner-e-commerc@www.ispo.cec.be
Reply-To: Vin McLellan <vin@shore.net>

Dave,
	I hope this might interest your IP community.
			      _Vin
-----------------------------

	Stewart Baker <sbaker@steptoe.com>, Washington attorney, acting
chairman of the President's Export Council's Subcommittee on Encryption,
former NSA General Counsel, and an usually savvy commentator on crypto
politics and US export controls, wrote on Dave Farber's IP List:

> RSA's Australian crypto announcement should be taken with a
> grain of salt. Australia may have somewhat more lenient
> encryption export practices than the US, but it is in fact
> closely aligned with the US on most such issues.

	Historically -- particularly, spook to spook -- this is certainly
true, at least in statutes and regulations controlling the export of
commercial crypto code exported from Australia on magnetic media. See Part
III, category 5/2, of the Australian Controls on the Export of Defence and
Strategic Goods. Crypto software at:
<http://www.dod.gov.au/dao/exportcontrols/greenbk/guidelin.htm> See also
the FAQ from Electronic Frontier, Australia, at:
<http://www.efa.org.au/Issues/Crypto/cryptfaq.html>.

> As I said to one reporter, moving from the US to Australia
> because you don't like US encryption controls is like moving
> from Minneapolis to Chicago because you don't like cold
> winters -- quite possibly an improvement but not exactly a
> solution.

	Great line, but....

	For many years, Australia has allowed the virtually unrestricted
distribution, over the Internet, of many of the most popular free
industrial-strength cryptosystems, crypto libraries, and crypto-enhanced
application packages. A public FTP site at the Australian Defence Force
Academy offers unrestricted downloads of PGPi, has for years. Imagine the
culture shock if the US suddenly became a nation in which West Point had a
website which offered free and trusted e-mail encryption software, over the
Internet, to any citizen of any country!

	Over the past five years, Australia has actually become the source
of choice for strong, free, and unrestricted cryptographic software -- in
large part due to the team of two Aussie cryptographers, Eric Young and Tim
Hudson, that RSA last year was lucky enough to recruit to manage
RSA-Australia, its new R&D crypto lab in Brisbane. How this came about is
the story of SSLeay; a tale any one of thousands of programmers and privacy
mavens around the world could readily retell.

	In 1995, Eric Young and Tim Hudson posted version 1 of SSLeay to
the Internet. SSLeay (eay for Eric A. Young) is a free cryptographic
library in which Young managed to single-handedly implement the full suite
of cryptosystems used in SSL: the RSA-based security protocol that provides
confidentiality, integrity, and "digital signature" authentication
functions for secure connections, transactions, and file transfers over the
World Wide Web (WWW) recently invented by European programmers.

	Since RSA's public key cryptosystem was patented only in the US,
Young was free to offer a full-strength "domestic US" version of the crypto
internationally, while American export regulations forced Netscape and
other US vendors to export browsers and web servers secured with no more
than 40-bit crypto -- a mere fraction of the 56/128-bit cryptographic
strength used in the otherwise identical products sold in the domestic US
market.

	That Eric Young and Tim Hudson made their SSLeay crypto library and
applications available to all without charge -- under a uniquely liberal
license which Hudson drafted to simply require that the code be properly
attributed and forever unencrumbered -- was a striking example of the
fabled freeware and shareware culture that has historically provided much
of the most creative and useful computer software, including most of the
Internet's protocols and essential data services.

	That there was a hungry market for SSLeay among corporate
developers who were, around the world, working on internal WWW-based
applications, and small independent developers who wanted to bring their
own SSL-enabled software to market, reflected the growing consciousness
among non-American consumers -- and particularly programmers and other
computer industry professionals -- that they were being sold only broken or
purposely-weakened security technology by American vendors.

	There was, and is, some inevitable bitterness among buyers of
computer and communications products which had been designed so that the US
signals intelligence agency, the National Security Agency (NSA), could
eavesdrop at will on supposedly secure transactions. Only Americans believe
that the NSA, and its sibling agencies from other nations, are rummaging
through the world communications net looking for child pornographers, drug
dealers, and terrorists.

	From 1996 on, crypto-enhanced free software quickly began pile up
on the SSLeay ftp and web site, now at: <http://www.cryptsoft.com.au>. From
there, it quickly jumped to hundreds, perhaps thousands, of freeware
distribution sites around the world.

	For v.1 of SSLeay, Hudson had already integrated SSLeay into
SSLapps, the core Internet services (FTP and Telnet,) and he soon added
full-strength SSL to international versions of several early browsers.
Other volunteers used SSLeay to enhance the remote service utilities of
UNIX. Young and Hudson worked with several teams which integrated SSL
functionality into the full-featured but free Apache webserver. (Another
Australian, Farrell McKay, independently developed Fortify for Netscape, an
ingenious hack which took advantage of a design weakness in the
NSA-approved Netscape crypto module which allowed the Fortify untility to
ungrade the the weak crypto in a Netscape export browser to full strength
SSL.) More recently, Young and Hudson led a team that overnight reinstalled
full-strength SSL into the published -- but crypto-stripped -- code of the
"Mozilla" browser that Netscape released in public domain last year.

	Working without pay -- coding for the sheer delight of creation and
in some tradition of service -- the Australian team transformed Mozilla
into "Cryptozilla," today available without restrictions from:
http://mozilla-crypto.ssleay.org/index.php

	Freeware and shareware are created wherever there are programmers,
but such free distribution of cryptography and crypto-enhanced privacy and
security products has never been allowed from the US. That Australia became
the nexus for the distribution unversally trusted free crypto
implementations involved Young, Hudson and more than a little chance.

	But there was also more than chance involved.

	Several Australian governments have proven unwilling or unable to
pass legislation that would have allowed the Australian Defense Department
(which has nominal control of crypto exports on physical media) to extend
its regime to cover the distribution of "intangibles," like software
programs, over the Internet.

	The current Australian government, led by Prime Minister John
Howard, has obviously been of two minds in its approach to crypto politics
and export controls on cryptography.

	On one hand, Australia is a beneficiary of the UKUSA partnership of
the English-speaking intelligence agencies. Australia has also been one of
the US's closest allies in the Wassenaar Arrangement
<http://www.wassenaar.org>, the diplomatically-cloaked coalition of
intelligence agencies which collectively seeks to restrict international
trade in dangerous munitions and "destabilizing" crypto-based privacy
technology.

	Last June -- shortly after Young and Hudson had helped create
Cryptozilla from the "open source" browser code published by Netscape --
Robbie Costmeyer, director of strategic trade policy and operations for the
Australian Defense Department, and the AU Wassenaar delegate, publicly
suggested that Young and Hudson should be prosecuted and jailed under
Australia's Weapons of Mass Destruction Act -- since they seemed to
otherwise elude the export controls he enforced.

	On the proverbial other hand, the reaction to Costmeyer's threat
was vehement and telling. Dan Tebbutt, The Australian's widely-read tech
columnist, ridiculed him in print as a Cold War martinet reminiscent of
Jack Nicholson's raving US Marine CO in the movie, "A Few Good Men." It
also quickly became apparent that Mr. Costmeyer was not speaking for the
government, nor even for the  Australian Defense Department.

	The Federal Minister for Communications, Information Technology and
the Arts, Senator Richard Alston, quickly jumped in to describe Australia's
"generous" cryptography policies as a golden opportunity for Australian
companies.

	Tebbutt, The Australian's columnist, paraphrased Mr. Alston: "Local
innovators have the chance to corner lucrative security markets beyond the
reach of dominant multinationals like IBM, Microsoft and Sun, who are
generally prevented from shipping their safest e-commerce products beyond
US borders. Yet the Minister emphasizes that the Government's attitude
falls short of a total green light."

	"We are very keen to promote the growth of trade in encryption
technology, but we do have to be mindful of law enforcement
considerations," Mr. Alston said. "I think the balance will move in favour
of commerce rather than law enforcement."

	Mr. Baker opined:

> I suspect that [Australian export] controls are the news hook, > but the
>commercial motivation is something else.

	Look more carefully, Counselor.

	True, Eric Young and Tim Hudson are folklore figures in the world
of Internet computing. And Young is now Chief Technical Officer for RSA
Data Security Australia Pty. Ltd., while Hudson is now Technical Director
for Development in RSA's new Brisbane-based crypto R&D center.(See
<http://www.aus.rsa.com>.) But -- contrary to a number of press reports --
there is a lot more to RSA-Australia than the recruitment of new executive
talent for RSA Data Security, Inc.

	RSA-Australia is the result of a long and careful campaign to woo
the Australian government with the prospect of high tech economic
development, and to push the US government to define the (perhaps still
evolving) guidelines that govern how non-US citizens -- who work outside
the United States, for an American-owned, but overseas-chartered, firm --
can be involved in development and sale of cryptographic products.

	I've been a consultant to Security Dynamics Technologies, RSA's
parent firm, for many years, but I'm not privy to the insider details.  The
immediate results seem apparent, however. Tim Hudson, Eric Young, and RSA's
CEO Jim Bidzos have cracked a door that could give RSA-Australia a
potentially lucrative role in the burgeoning global market for e-commerce
infrastructure.

	After extensive negotiations and consultations with RSA, Canberra
last year decided to give RSA-Australia a license to sell and ship RSA's
new  (SSLeay-based) BSAFE SSL-C toolkit to developers and implementors,
anywhere but in the so-called "pariah" nations, with merely routine
reporting requirements.

	Like SSLeay, the several cryptosystems and protocol modules in the
BSAFE SSL-C library -- "secure protocol components for C," at
<http://www.aus.rsa.com/products/sslc/index.html> --
provides the full suite of strong symmetric and public key cryptosystems
used in the SSL v.1&2 and TLS v.1 -- the trusted and secure SSL
implementation that any 10 year-old American boy or girl gets when he or
she downloads a free "domestic-grade" Web browser from Netscape or
Microsoft.

	In the international computer security market, the advent of BSAFE
SSL-C is a big deal. I expect you will soon hear of major deals between
RSA-Australia and prominent non-American computer and communications firms.

	RSA's endorsement and pledge of commercial-grade support for Eric
Young's code modules should give BSAFE SSL-C legs among prospective
corporate buyers world-wide, as these firms seek to integrate strong and
trusted crypto into internal applications and their software and hardware
products. RSA's corporate credibility and its reputation for quality code
and technical support is such that it can, and does, charge a premium when
it sells a "Genuine RSA" module of DES code in Japan and other parts of
Asia. For a cryptographic security firm, reputation _is_ its core product.

	RSA Data Security (RSADSI) is best known for its US-patented RSA
public key cryptosystem. The RSA "PKC" is a cryptographic protocol which is
today used almost universally to create "digital signatures" and to
securely exchange crypto keys among individuals with no prior contact.
Today, this RSA technology provides the foundation of online electronic
commerce -- and e-commerce, many hope, will be the Economic Engine of the
21st Century.  RSA's master cryptographer Ron Rivest (the "R" of RSA)
continues to teach at MIT in Cambridge, Mass., but he is also widely
regarded as one of the most creative and productive minds in his field.

	Coinventor of the RSA public key cryptosystem 20 years ago, Rivest
has since invented a number of the world's most widely used commercial
cryptosystems for RSADSI: RC2, RC4, and recently, RC5, now an official
candidate to replace the American DES. He also designed two of the most
widely implemented "hash" algorithms: MD4 and MD5.

	Australia's breakthrough policy on crypto exports -- if it is seen
as stable -- is also expected to spur collateral economic development. (A
senior Irish official last year reported that his government believed that
Ireland's "progressive" stance on crypto export controls had lured over 400
foreign companies to set up offices and plants in Ireland in recent years.)

	Australia's Howard Administration has apparently concluded that the
development of a crypto-savvy industrial sector now is "crucial" to
Australia's 21st Century  prosperity. Major figures in the Australian
Defense establishment have also made it clear that they believe that the
Commonwealth, for its own national security interests, must have a
homegrown crypto industry.

	Given the size of the Australian home market, attracting the
investment this will require obviously means crypto exports. And it has
always been clear that Australia could only competitively export if it
licensed commercial developers to export full-strength, industry-standard,
strong crypto products and toolkits. The world "infosec" market is not
defined by Wassenaar; quite the contrary: 56-bit crypto simply doesn't meet
minimal corporate "good practice" standards in many places.

	The US Dept. of Commerce told the Wall Street Journal that the key
to the legality (under US law) of RSA-Australia's trade in cryptographic
modules is that "neither U.S. technology or U.S. personnel could be
involved in making the product."

	(Isn't it interesting to see how many industry observers have
expressed surprise to discover that there are apparently some limits to the
jurisdiction of US law over foreign nationals -- even if those non-American
citizens work for an US-owned firm outside the US?  Revelation!

	(Yet there is a lesson here. When the NSA conceded that, indeed,
there had to be some limit, RSA worked diligently with the US Commerce
Dept.to define that limit and forge concrete guidelines.  For a company
which fought a decade-long guerrilla war against the NSA -- during which
the NSA spent millions trying to crush RSA in the marketplace, vigorously
promoting its DSS and Fortezza as a public-key-crypto alternative to RSA's
namesake cryptosystem -- this was an interesting display of confidence. Sun
Microsystems tried a frontal attack on US export controls with a Russian
subsidiary; firms like C2Net and Network Associates ignore the rules and
exploit loopholes in the law to export crypto. But name another vendor
which has done the dance with the US Commerce Dept. and come out of it with
something positive and useful?)

	When unnatural allies are forced to work together, US diplomats
used to call it "constructive engagement."

	On the Cryptography mailing list, a number of top security
architects (Rich Salz of CertCo, Steve Bellovin of AT&T Research, Ben
Laurie of the Apache Group and OpenSSL) wondered where and how the line was
drawn between US technology and non-US technology -- especially since some
of the cryptosystems RSA-Australia was offering (RC4 for example) were
based on proprietary RSA products, and most were invented in the US.

	As I've heard the story, Young and Hudson, representing the nascent
RSA-Australia, worked for months to prove to technical examiners from US
Commerce and the NS were directly based on any code or technical analysis
developed in the US of A.
It is largely because of this that the BSAFE SSL-C crypto library is so
different from Young's SSLeay library of algorithms and protocol modules.

	Reverse-engineered versions of Rivest's RC2 and RC4 cryptosystems
have been anonymously published on the Internet, but -- because the source
was unknown -- that alone was not enough to document a non-US source. (By
1998, of course, RC2 was no longer merely American: Rivest had published an
Internet RFC describing the algorithm as part of RSA's campaign to promote
an Internet standard based on its S/MIME protocol for e-mail encryption.)
Where there was no solid and explicit documentation of a non-American
source for a SSLeay crypto module, Young had to toss it out and
reimplement. (Ironically, RSA had years earlier purchased Eric Young's
speedy DES implementation as the basis for the DES module in RSA's
industry-standard BSAFE (US) toolkit for software developers. The RSA
manuals duely credit E. Young.)

	Young eventually decided to completely reimplement both RC2 and RC4
so he could fully document that all of the code intended for BSAFE SSL-C
was based on documentation readily available worldwide. Young's new
implementation of RC4 was based on conference proceedings readily available
in technical libraries worldwide, but RSA engineers still had to bring in
Rivest's RC4 reference code to prove that the two RC4 modules were coded
quite differently. Young and Hudson also provided testimonials from other
prominent Australian cryptographers that RSA's RC4 algorithm could be
readily coded from purely public information that was freely available in
many countries.

	The eventual result was that Young's BSAFE SSL-C code was
eventually certified, by officials in both nations, as 100-percent
Australian.

	Australia licensed RSA-Australia to commercially export BSAFE SSL-C
before the Wassenaar group met in December to recommend new rules for how
the 33 participating states, including Australia, should manage crypto
exports -- but the changes don't seem likely to affect the BSAFE SSL-C
license.

	(The Wassenaar security delegates to now urge the participating
nations to establish new export controls over "mass market" software which
uses crypto with keys longer than 64-bits, and to restrict other symmetric
crypto software and hardware with keys longer than 56-bit keys (unless a
formal export license is issued by the respective national government. What
this might mean in practice is as yet unclear.)

	To judge from semi-official comments from authorities in Canada,
Finland, and Ireland -- three nations which have made major efforts to
promote the development of a domestic crypto industry -- the new Wassenaar
recommendations will cause few if any changes in their current procedures
for overseeing exports from their prized crypto entrepreneurs. Any control
system that requires exporters to apply for a license, if sufficiently
speedy and predictable, can be almost transparent in the sales process.

	There is apparently a great deal of leeway in how the Wassenaar
"signatories" implement the Wassenaar recommendations and regulate their
cryptographic exports.

	Despite some attempts to portray it as international law, the
Wassenaar Arrangement is not even a treaty. It is more like a Memorandum of
Understanding among the participating nations. The two probably fatal flaws
in the Wassenaar scheme are (a) that not all nations which produce
cryptosystems are in the Club, and (b) the members of the Club are
infinitely creative in their interpretation of the rules. (Surely, since
their national interests vary, to expect otherwise is naive.)

	Exploiting the market opportunities created by the NSA's effective
control over US export controls is now a mainstay of formal economic
planning in, for example, the European Community. See the "European Expert
Hearing on Digital Signatures and Encryption":
<http://www.fsk.dk/fsk/div/hearing/krypt.html> Is it surprising that the
crypto-savvy Aussies now want to do more than waltz with Matilda?

	In late December, as the decision of Eric Young and Tim Hudson to
go commercial and join RSA became known, there was some consternation among
those who depend upon (or whose business plan depends upon) a free
cryptographic library. It was misplaced. Tim Hudson had crafted the unusual
SSLeay license so that no one -- not even Eric Young or himself -- could
bottle up the code they have released and claim it as proprietary. RSA's
new BSAFE SSL-C library is a different product. Although the functionality
is today similar, BSAFE SSL-C will soon be expanded with new additions from
Young and other RSA-Australia developers.

	With the SSLeay license, however, the two Australian entrepreneurs
are both leaving their SSLeay work behind, in the public domain, for others
to use and further develop, _and_ carrying parts of it into the commercial
software market where RSA-Australia will sell it. SSLeay continues to be in
wide circulation, freely available, even as the BSAFE SSL-C library is sold
with the extensive documentation and promise of ongoing technial support
that RSA traditionally offers it OEM customers.

	There is clearly room for both. There are business strategies that
require many corporations to purchase "mission critical" software -- with
clear responsibility (and liability) for quality assurance, maintenance,
upgrades, and future development -- and there are others which presume the
developers can obtain free code modules.

	There was a briefly contentious effort to organize a new group of
primary developers to continue to develop Young's SSLeay library and to
adapt it to the evolving Internet protocols and new opportunities.
Americans, by law, are unfortunately forbidden to engage in the sort of
transnational Internet-based  cryptographic development this entails, but a
number of leading talents in "open source" crypto have banded together in
an "OpenSSL" organization to carry on the SSLeay tradition. See:
<http://www.openssl.org>

	Meanwhile, RSA in the US is about to launch yet another of its the
"Challenge" contests with which it has repeatedly battered US crypto export
controls, with painfully objective evidence of the relative insecurity of
the "security" products the Clinton Administration permits American firms
to export.

	This "DES Challenge III" contest, which will begin at 9 am on Jan.
18th, has contestants racing against the clock to crack the US DES. RSA
promises a $10,000 award to whomever can "crack" and read a message
enciphered with the 56-bit DES in less than a single day.

	(The most interesting contestant will surely be the
Internet-coordinated attack by thousands of PCs, organized by
Distributed.Net, since DN has also integrated the EFF's custom-designed DES
Cracker, "Deep Blue," as a distributed.net client. DN coordinators have
been running test races to recruit volunteers and build momentum. Speedy
DES-Cracker client software for multiple platforms can be downloaded by
anyone wants to participate. See: <http://www.distributed.net/des/>.)

	RSA's symmetric crypto "Challenge" contests have had a major impact
on US and international policy and practice. Year by year, they have
systematically destroyed many government-fostered illusions about the
relative security of the restricted-strength cryptosystems which the
Wassenaar coalition of intelligence agencies prefer to be used by citizens
(who are not government officials) and corporate and commercial entities.

	RSA's first Challenge contest, launched in January, 1997, saw grad
student Ian Goldberg use an UCLA network of a couple hundred PCs to crack a
40-bit cipher in three and a half hours. At the time, a 40-bit ciphers was
the strongest cryptographic security software the US government would allow
sold overseas without a sale-specific license approved by the NSA.

	US export regulations were subsequently changed to allow for the
export of 56-bit DES in commercial products -- but only by those vendors
who promised to design a "key recovery" mechanism into their products, so
as to allow surreptitous third party access to encrypted stored data or
communication links by appropriate, and duely authorized, government agents.

	The DES itself was first cracked in June, 1997, by the DESCHALL
network organized by Rocke Verser of Loveland, Colorado. DESCHALL used the
Internet to tap the spare cycles of some 70,000 computers (mostly desktop
PCs) over four months. DESCHALL won a $10,000 award from RSA by decrypting
the message: "Strong cryptography makes the world a safer place."

	However, the very scale of the effort involved was used by senior
US intelligence officials to reassure Congress and corporate users that
56-bit crypto was still robust enough for civilian use. Some thought those
officals had missed the point.  Last year, to better drive home the
"marginal security" of 56-bit DES, RSA organized another series of 6-month
DES Challenge contests in which participants would race the clock to crack
DES -- still, even now, the mainstay of corporate security in the US, and
in much of rest of the world..

	After the Electronic Frontiers Foundation (EFF) built its $220,000
special-purpose DES Cracker ("Deep Blue") and decrypted a DES-enciphered
message in only 56 hours in the July '98 RSA Challenge, the statements of
top NSA and Justice officials to the US Congress and US businessmen --
assuring them that the DES was still robust enough that industry and much
of government could depend upon it -- looked absurd, even deliberately
misleading.
(See, for example, Cowell and Freeh; June '97 Congressional Testimony. at:
<http://jya.com/hir-hear.htm>)

	The Wassenaar recommendations were again modernized to catch up. In
the US, however, even with the most recent updates -- new special
exemptions for powerful industry sectors like banking and insurance; and
(finally!) an end to the extortionate demands that US vendors build
key-recovery "backdoors" into their products to get DES export permits --
US export regulators continue to restrict US hardware and software exports
to crypto no stronger than 56-bit DES.

	In what is still probably the most irksome aspect of the current US
system to American firms which are potential exporters, the Commerce
Dept.'s export licensing procedures for crypto, and crypto-enhanced
computer and communications products, remains inherently subjective,
enormously time-consuming, and largely unpredictable.

	With American products freely shipped overseas only with broken or
"marginal" DES security, many non-American firms -- most, but not all, from
the Wassenaar nations --  have actively and very successfully sought to
expoit the overseas market opportunities created by US export controls and
US crypto politics.

	Now, RSA-Australia -- fair dinkum RSA, for all the new blokes --
can get a piece of the pie.

	Suerte,

		_Vin

-----
"Cryptography is like literacy in the Dark Ages. Infinitely potent, for
good and ill... yet basically an intellectual construct, an idea, which by
its nature will resist efforts to restrict it to bureaucrats and others who
deem only themselves worthy of such Privilege."
_ A Thinking Man's Creed for Crypto  _vbm.

 *     Vin McLellan + The Privacy Guild + <vin@shore.net>    *
      53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548

 <footer cruft stripped for distribution on nettime-l>
---
#  distributed via nettime-l : no commercial use without permission
#  <nettime> is a closed moderated mailinglist for net criticism,
#  collaborative text filtering and cultural politics of the nets
#  more info: majordomo@desk.nl and "info nettime-l" in the msg body
#  URL: http://www.desk.nl/~nettime/  contact: nettime-owner@desk.nl