Re: Non-US Crypto HW

[Wouter Slegers <wouter@yourcreativesolutions.nl>]

On Mon, Jun 03, 2002 at 02:35:05PM +0200, Xander Soldaat wrote:
> On Monday 03 June 2002 13:25, Theo de Raadt wrote:
> > Many people outside the USA have succeeded at buying these cards from
> > these guys, and are using them with OpenBSD.
> I realise this. My problem is a little more complex than just getting 
> the hardware from the US. My problem is the fact that the company I am 
> currently working for cannot export US based hardware to the countries 
> involved (supposed axis of evil and that sort of thing).
A cautionary note on the legal aspects:
If the clients are in countries on the banned list for the BXA, they are
very likely also on the forbidden lists for all other countries that
follow the Wassenaar agreement (for further information, see
http://www.wassenaar.org/ and Bert-Jaap Koops Cryptolaw survey at
http://rechten.kub.nl/koops/cryptolaw/). Although widely ignored, export
of high-grade (as in: >56-bit keys) crypto devices like these is nearly
always restricted and subject to export laws, including in The
Netherlands where you seem to be based.
This also includes shipping "crypto with a hole" i.e. trying to
circumvent these rules by building a system that can do "high-grade"
crypto by simply adding a component, which you are describing.
In short: this is dangerous legal ground you are treading.

With kind regards,
Wouter Slegers

-- 
Wouter Slegers
Your Creative Solutions
"Security solutions you can trust and verify."