SFL Availability to non-NorthAmericans

Gentlemen and SFL followers,

I'm sure I represent "The Rest Of" the internet community concerned with secure electronic commerce in complaining about the restriction of SFL source code to North Americans.

I know that both John and Paul would prefer that it is available, because the SFL is DESIGNED to be separate from the export controlled cryptographic libraries, and this is not what the IMC is about either.

I have been following the development of the SFL for some time, and have even downloaded a version of it previously. I believe the whole concept of a reference implementation is a great idea, as it is only going to push the industry forward into interoperability - and that's what the industry is all about. Fine, control the crypto, we have our own - that's easy, but when you have something as complex as S/MIME, only a reference implementation is going going to make it practical in the short and medium term. Lets get people using it.

Now, thats my speel. How do we go about changing this situation? Who do we contact in the DoD.

Regards,
Owen Roberts


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Owen Roberts - Systems Architect
Zergo Asia Pacific, Sydney Australia
(+612) 9929 9650
mailto:[email protected]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




The underlying, external
crypto token libraries are not distributed as part of the SFL source code.
The application developer must independently obtain these libraries and then
link them with the SFL.   This strategy allows the SFL source code to be
freely distributed to the entire Internet community because it does not
contain software that directly implements any crypto algorithms that are
copyrighted or export controlled.
[John Pawling April 98]


I'm sorry to announce that the source code for the SFL has been removed
from the official site. It has been moved to a new site,
<http://www.armadillo.huntsville.al.us/software/smime/> that appears to be
export-controlled. You need a password to get the software from that site,
and the passwords are handed out by the US Department of Defense.

I'm personally embarssed that the government of my country enforces such
silly laws. I understand that many other countries have similar laws, but
that doesn't make me feel any better. I had hoped that the SFL would be the
beginning of sensibility on the part of the US government with respect to
cryptography distribution; I still have that hope for the future.

--Paul Hoffman, Director
--Internet Mail Consortium
[May 5]



I regret to inform you I cannot process your account request.  In a
nutshell, my organization runs the web page.  We do not have control
over what is and isn't export controlled.  While many people feel, as
you do, that portions should be accessable, I do not have the authority
to make them accessable.  The IMC at www.imc.org has more information on
this issue and may point you to someone who properly assist you.  I'm
sorry I couldn't help you.

Lloyd Craig
[August 6]

----------
From: 	John Pawling
Sent: 	Tuesday, August 04, 1998 1:30 AM
To: 	Owen Roberts
Subject: 	Re: SFL Availability

Owen,

Enclosed is the most recent message that I sent regarding the SFL.  The
ASN.1 software portions of the SFL are available to everybody at
http://www.armadillo.huntsville.al.us/software/smime.  All other portions of
the SFL are export controlled as per U.S. export laws.  Please take special
note of the following paragraph from the enclosed message:

"Instructions for applying for an account on the Fortezza Developer's S/MIME
Page are available from that page.  An account is required to download the
SFL files from the Fortezza Developer's S/MIME Page due to U.S. export
restrictions.  See the U.S. Bureau of Export Administration's Commercial
Encryption Export Controls web site at http://www.bxa.doc.gov/encstart.htm
for more information regarding the U.S. export restrictions."

The U.S. Department of Defense (DoD) Export Control Policy office ruled that
the SFL source code and binaries are covered under the US export laws.  The
US export laws include some exceptions.  In some cases, export-controlled
software can be distributed to other than US citizens.  For more info,
please contact Lloyd Craig, DoD, Office X22, Telephone: (410) 859-4463.
Also, you can contact Jim Madsen, DoD Export Control Policy office,
301-688-7834.

- John Pawling


At 01:51 PM 8/3/98 +1000, Owen Roberts wrote:
>Hi John,
>
>I downloaded v0.3 (March 98) of the SFL from the jgvandyke.com pages some
time ago. It used to be the case that there was no export control on this
software, only on the crypto libraries to use with it like Crypto++. It
seems now that the SFL is export controlled as well, as seen on
http://www.armadillo.huntsville.al.us/software/smime/ where it now resides.
>
>Is this correct? Please tell me non-NorthAmericans will be able to use the SFL.
>
>Thanks for your time,
>Regards,
>Owen Roberts.