"Mason, Shane" <smason@blockade.com> writes:

> I must concur with Erik.  There needs to be a non-US source for
> distributions that have full crypto.  Using RSA has licensing issues, but
> DES, 3-DES, IDEA, CAST, DSA (I think), are all public domain.  The only
> issue is export from the US.

RSA has no real licensing issues if distributed in source form. ssh,
openssl, gnupg and many other projects which are far more "visible"
than NetBSD can and do distribute RSA (and IDEA) in source form. With
the RSA patent about to run out, I'm depressed that anyone would
consider this a live issue.

There will be a non-us NetBSD crypto distribution in the near
future. Although one wonders whether us crypto-export restrictions
might have disappeared completely by the time it happens.

> countries.  This is something for a lawyer to determine, and also only an
> issue if the US Justice Department can figure out which US citizens were
> working on the code.

Lawyers work in the fantasy land of the Law, and not in the Real
World. Anyone who lets a lawyer determine anything is a fool. Factor
their views into your decision making, but never, ever give them the reins.

> The best person to call on for advice is probably Theo de Raadt.  At least,
> he is the only person on the OpenBSD development team that I have met (and
> then only for about 30 seconds).  For those who do not know him, he works on
> the OpenBSD project, and would have some useful insight about ITAR, legals,
> etc.  It is my understanding that part of the reason that OpenBSD is based
> in Canada is because of ITAR.
> 
> ICMan

The primary reason OpenBSD is located in Canada is that Theo had it
cushy in Calgary. I applaud the stoicness of the US OpenBSD crypto
developers (i.e NRL), who are willing to sail ever so slightly close
to the wind by pushing crypto-code from the US to Canada (and
implicity, then to the rest of the world). But it is important to
remember what country Theo is in, and exactly who is bring brave in
this equation. I wish *our* US devlopers were willing to do the same
thing, however thus far I've seen no sign of it.

Julian.