3DES key-length

[Dan Kaminsky]

> Interesting story, indeed!
>
>> > I am interested in the export regulations concerning openssh in USA.
>> Any idea on this ?
>>
>> Should be pretty free of US regs; all the crypto modules are imported
>> from Canada / Germany / Etc.
>
> But, how about the regulations concerning export of OpenSSH from the USA
> to other countries, (because of 128 bit key encryption used!) ?

Well, the idea is that OpenSSH is actually imported *into* the United
States, so it's not particularly under local jurisdiction.  However, using
an RPM by an American distributer might change that.  So use the tarball
to be sure.

If I remember right, Clinton signed an executive order a couple years back
massively simplifying the process of exporting effective cryptography from
the states...something along the lines of "Send an email to this address
at bxa.gov, and you're done".

Of course, if you're actively sending to one of the nine or ten Verboten
countries(Iraq, North Korea, Sudan, etc.) all bets are off.

--Dan