Re: [gentoo-dev] Encryption Export

[Preston A. Elder]

On Wed, 2002-04-17 at 21:50, Ryan Phillips wrote:
>   Gentoo provides ebuilds, source archives, and binaries for openssl,
> gpg, and many other high-encryption packages off of its own website and
Binaries and source could be a problem, however ebuilds are irrelevant
-- they contain no cryptographical information in and of themselves, and
do not enable anyone to encrypt anything with high-encryption.

> PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY
> SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING
> TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS
> OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-
> DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS OR
> EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE YOU ARE STRONGLY
> ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT AND/OR USE LAWS
> WHICH APPLY TO YOU. THE AUTHORS OF GENTOO ARE NOT LIABLE FOR ANY
> VIOLATIONS YOU MAKE HERE. SO BE CAREFULLY YOURSELF, IT IS YOUR
> RESPONSIBILITY.
even your disclaimer doesnt mention ebuilds -- ebuilds arent considered
'technical details'.

> In addition, I propose the RESTRICT variable for ebuilds.  This would
> make source archives not be mirrored on the gentoo/ibiblio site, and
> it's mirrors.
THIS is a very good idea.  Especially for things like openssl, and the
proposed ebuild of cryptoapi.  If its not on our mirrors, its not our
problem to enforce export controls.

> Onto the subject of binary CDs.  There should probably be two sets of
> binary CDs: one with high encryption, and one with export grade.  To
> download the high encryption ISO, the website could ask the user if they
> agreed to the export license, or under FTP the license could be stored
> as a .message.  A more simpler solution is to take out openssl/openssh
> altogether, since they are relatively small downloads.
Keeping in mind, that no matter what license you make people agree to,
in some cases, its simply illegal to export encryption technology
outside the US above a certain grade.  Forget about import restrictions
on the user's side, unless you have explicit permission from the
government, you cannot even offer encryption technology (binaries or
source code) above a certain grade outside the US.

As I said, as long as we don't mirror the stuff, we don't have to worry
about export restrictions -- all we're exporting is something saying 'we
got it from here, and if it works for you, great! heres how to build
it', but thats not illegal (its covered under the first amendment).

As for the ISO's, if you have a high and low encryption ISO, then you
will have to make some reasonable measure to ensure the person
downloading the high encryption ISO is in the united states.  Keeping in
mind, this does not apply to all packages -- some packages (eg. mozilla)
have permission to be distributed internationally by whomever.

I would go with your suggestion of removing anything thats export
controlled from the ISO, and letting the user emerge it.

> Best regards,
> Ryan Phillips
> rphillips at gentoo.org

> [Note: I am not a lawyer, and this should not be considered legal
> advice.]
Nor am I, but my company has had to deal with encryption export laws
before, and I myself write something with encryption technology in it.

-- 
PreZ
Systems Administrator
GOTH.NET

Goth Code '98:   tSKeba5qaSabsaaaGbaa75KAASWGuajmsvbieqcL4BaaLb3F4
                 nId5mefqmDjmmgm#haxthgzpj4GiysNkycSRGHabiabOkauNSW

GOTH.NET - http://www.goth.net
Free online resource for the gothic community.