Subject: Re: Exportable encryption & Kerberos ?Date: Mon, 12 Jan 1998

From: David Hemsath <[email-masked]>
Date: Mon, 12 Jan 1998 21:03:57 -0500

You might want to consider something less "US-Centric" for your proposal.  In a
recent Open Group meeting, several members from Europe brought up the fact that
other countries have their own sets of crypto import/export laws, so it's more
than just the U.S. Govt's regulations to deal with here.

The DCE community has been investigating the possibility of using the new
Common Data Security Architecture's (CDSA's) crypto facilities to enable DCE to
be shipped w/o a crypto engine for user data confidentiallity, and then hooked
up at installation with a local governing authority-approved crypto service
provider that plugs in "underneath" CDSA.  IBM and Intel both have CDSA
implementations with more than one crypto service provider.

David K. Hemsath, IBM DSS Security Strategy & Architecture