I was approached by a legal firm with the questions below about Python's crypto capabilities, from the POV of a legal review of exporting software that embeds Python. I don't have time to research the answers myself (I'm no crypto expert). If you think you can answer the questions, please send me a price quote and I'll forward it to them. They'd like the answers ASAP. --Guido van Rossum (home page: http://www.python.org/~guido/) ------- Forwarded Message
Hello Guido,
[...]
I understand Python is open source, but when open source code is integrated in a commercial product, the owner of the commercial product must include the open source code in their product analysis for U.S. export classification purposes. Although as open source, Python falls under an export control exception, this exception is lost once the code is offered in a commercial product.
I would appreciate your help in obtaining some additional technical information in order to complete my export classification analysis.
[...]
1. We have been advised the following encryption content is in Python. We are looking for additional information regarding the encryption content: a. The Rotor module, which implements a very ancient encryption algorithm based on the German Enigma. Please tell us the symmetric key length of the encryption contained within this module. Please also advise the asymmetric key exchange algorithm length. b. The wrapper module for Open SSL. Again, please tell us the symmetric key length of the encryption content contained within this module. Please also advise the asymmetric key exchange algorithm length c. The following questions apply to both the Rotor module and the wrapper module: i. can the encryption function be directly accessed, or modified, by the end user? ii. Do either of these encryption components contain an "Open Cryptographic Interface" (an interface that is not fixed and permits a third party to insert encryption functionality)
The following chart is an example of the type of information I need to submit to the U.S. government. Would you be able to provide similar information regarding the encryption component(s) included within Pyton?
EXAMPLE:
Algorithm Source Key-min Key-max Modes RC2 OpenSSL 40 128 CBC, ECB, CFB, OFB ARC4 OpenSSL 40 128 N/A (stream encryption) DES OpenSSL 40 56 CBC, ECB, CFB, OFB DESX OpenSSL 168 168 CBC 3DES-2Key OpenSSL 112 112 CBC, ECB, CFB, OFB 3DES OpenSSL 168 168 CBC, ECB, CFB, OFB Blowfish OpenSSL 128 CBC, ECB, CFB, OFB Diffie-Hellman OpenSSL 192* 16384* Key-exchange, authentication
DSA OpenSSL Digital Signature MD5 OpenSSL Integrity SHA-1 OpenSSL Integrity * No explicit limit, these appear to be the practical range of values.
[...] ------- End of Forwarded Message
participants (1)
-
Guido van Rossum