[3889] in cryptography@c2.net mail archive
RE: Triple DES "standard"?
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Fri Jan 1 14:21:30 1999
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: ptrei@securitydynamics.com
Cc: Cryptography@c2.net
Reply-To: pgut001@cs.auckland.ac.nz
Date: Fri, 1 Jan 1999 17:08:56 (NZDT)
"Trei, Peter" <ptrei@securitydynamics.com> wrote:
>I can partially confirm this - a couple of years ago (at a previous employer)
>I incorporated SSL into an NT web server (using SSLeay). The standard version
>used 3DES to encrypt server private keys for storage on the server (not for
>transmission). The NSA initially refused export permission, based on this
>feature. I lowered the bar to single DES, and they were happy.
Adding my $0.02 worth of NZ perspective, in 1996 MFAT/the GCSB specifically
disallowed triple DES in an export request while apparently overlooking
algorithms with much larger key sizes (Blowfish, RC5, etc). As I've pointed
out elsewhere, this was just copying what the NSA was doing, but it shows that
the anti-3DES policy was being applied in places other than the US.
Peter.
