I work for a company that builds an appliance based on FreeBSD (4.X) and we've just had our first question come up about exporting the appliance out of the US (specifically the EU). Since FreeBSD uses OpenSSL/OpenSSH, I'm under the impression that we need to gut out anything higher than 56bit (3DES/etc) crypto out of it. I would really appreciate it if someone could point me in the right direction on this :) -Tom
On Wed, Apr 12, 2006 at 11:32:40AM -0700, Tom wrote:> I work for a company that builds an appliance based on FreeBSD (4.X) and > we've just had our first question come up about exporting the appliance > out of the US (specifically the EU). > > Since FreeBSD uses OpenSSL/OpenSSH, I'm under the impression that we need > to gut out anything higher than 56bit (3DES/etc) crypto out of it.Only if it's still 1995 in your timezone, AFAIK. Kris -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: not available Url : http://lists.freebsd.org/pipermail/freebsd-security/attachments/20060412/342529e0/attachment.pgp
On Wed, 12 Apr 2006, Iang wrote:> Nope, that is old. If it is software & the crypto is freely > available off the net, then it is not "controlled".Hrm, so even though we're selling an "appliance", it doesn't change anything?> The specific restrictions were lifted by Clinton Jan 2000 from > memory, for americans.Hrm, any idea on what part of the export code its in? I've been reviewing a lot of government documents and they all seem to point at it being an "advisory license". -Tom
Tom <bifrost@minions.com> writes:> I work for a company that builds an appliance based on FreeBSD (4.X) > and we've just had our first question come up about exporting the > appliance out of the US (specifically the EU).> Since FreeBSD uses OpenSSL/OpenSSH, I'm under the impression that we > need to gut out anything higher than 56bit (3DES/etc) crypto out of it.> I would really appreciate it if someone could point me in the right > direction on this :)Find a good lawyer familiar with export control issues - the rules are complicated. -- Greg Troxel <gdt@ir.bbn.com>