Q: I heard that the US
Government has relaxed the export restrictions on encryption products.
How does this affect JCE 1.2 and JCE 1.2.1?
A: There has been some relaxation in the
export requirements for encryption products.
Go to http://www.epic.org/crypto/export_controls/regs_1_00.html for a
complete 33-page report on current export requirements.
Note also that a vendor's product status is dependent on the type of application they have with the government and at what point
the product was in in the government's application process when
the new regulations passed. Contrary to some articles in the press, export of
encryption items is still a complicated, multi-dimensional issue.
JCE 1.2 is still not exportable, because
export control restrictions by the U.S. Department of Commerce prohibit
frameworks for encryption services from being exported unless appropriate
mechanisms have been implemented to ensure that only qualified providers can
be plugged into the framework. JCE 1.2 does not implement such mechanisms,
but JCE 1.2.1 does.
This makes JCE 1.2.1 exportable worldwide (except to the embargoed
countries listed in the previous answer and those on the
Denied and Restricted Parties List).
JCE 1.2.1 also includes an ability to enforce restrictions regarding the
cryptographic algorithms and maximum cryptographic strengths available to
applets/applications in different jurisdiction contexts (locations).
The cryptographic restrictions are specified in "jurisdiction policy files"
that are downloaded with JCE 1.2.1. Since the US government has relaxed
export restrictions on cryptographic strengths, the JCE 1.2.1 software
from Sun Microsystems now has a single distribution for both domestic and
global users. The bundled jurisdiction policy files contain no restrictions
on cryptographic strengths. This is appropriate for most countries.
Other framework vendors could create download bundles that include
jurisdiction policy files that specify cryptographic restrictions
appropriate for countries whose governments mandate restrictions.
Users in those countries could download an appropriate bundle,
and the JCE framework will enforce the specified restrictions.