Subject: (IPng 7067) France decontrols crypto

From: "Perry E. Metzger" <[email-masked]>
Date: 19 Jan 1999 20:16:26 -0500

According to many reports sent to the [email-masked] mailing
list, France has decided to eliminate its domestic encryption
controls. The reports claim that pending legislation entirely removing
these controls, the permitted limit on conventional ciphers is being
administratively raised from 40 bits to 128 bits.

I hope this means the INRIA people are now going to be able to help
work on IPSEC for the Unified BSD IPv6 stack. :)

Perry

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Wed, 20 Jan 1999 10:27:09 +0100

In your previous mail you wrote:

=> it is only a political statement. The last time freedom has been
promised and we got a restrictive law and it took near 20 months
to get more restrictive application decrees... But now it seems
there is a real political will (without an important election
in some months :-).

=> it will be a good thing !

Thanks

[email-masked]

PS: references (LONG):
 the speech is at http://www.premier-ministre.gouv.fr/PM/D190199.HTM
 (premier-ministre = first-minister, gouv = gov, D is from discours = speech,
  the date is in European format (day-month-year))

 Le Gouvernement a donc décidé de présenter
 progressivement au Parlement un ensemble de
 propositions relatives au document numérique et à la
 signature électronique (a), à la protection des données
 personnelles (b) et enfin la cryptologie (c).

 (so the Government has decided to present gradually to the Parlement
  a set of proposals relative to the digital document and to the
  electronic signature (a), to the protection of personnal data (b)
  and finally to the cryptology (c).)

 (c ) Le troisième chantier législatif concerne la
 cryptologie. Alors que se développent les moyens
 d'espionnage électronique, la cryptologie apparaît
 comme un moyen essentiel pour protéger la
 confidentialité des échanges et la protection de la vie
 privée.

 (c: The third legislative task is about the cryptology.
  When electronic spying abilities spread, the cryptology
  appears to be an essential tool for the protection of
  the confidentality of exchanges and of the privacy.)

 Nous avions, il y a un an, franchi un premier pas vers la
 libéralisation des moyens de cryptologie, c'est à dire la
 technique qui assure la sécurité des échanges de données
 sur les réseaux. J'avais annoncé alors que nous en
 franchirions un autre ultérieurement. Le Gouvernement
 a, depuis, entendu les acteurs, interrogé les experts et
 consulté ses partenaires internationaux. Nous avons
 aujourd'hui acquis la conviction que la législation de
 1996 n'est plus adaptée. En effet, elle restreint
 fortement l'usage de la cryptologie en France, sans
 d'ailleurs permettre pour autant aux pouvoirs publics de
 lutter efficacement contre des agissements criminels
 dont le chiffrement pourrait faciliter la dissimulation.

 (One year ago we have done a first step towards the liberalization (?)
  of cryptology devices, ie the technical way to insure the
  security of data exchanges on networks. I announced
  at this time that we should do another step. Since
  the Government has consulted actors, experts and international
  partners. Today we have got the conviction that the 1996 law
  does no more fit. Indeed it greatly limits the use of cryptology
  in France, and anyway does not give to the authorities an
  efficient tool against criminal acts which should be conceal
  with the help of cryptology devices.)

 Pour changer l'orientation de notre législation, le
 Gouvernement a donc retenu les orientations
 suivantes dont je me suis entretenu avec le Président de
 la République :

 (In order to change the trend of the legislation, the
 Government has accepted the following ideas after
 an interview with the President:)

 - offrir une liberté complète dans l'utilisation de la
 cryptologie ;

 (- give a complete freedom for the use of cryptology
  (Note: use, not supply))

 - supprimer le caractère obligatoire du recours au tiers
 de confiance pour le dépôt des clefs de chiffrement ;

 (- abolish the mandatory usage of trusted parties)

 - compléter le dispositif juridique actuel par
 l'instauration d'obligations, assorties de sanctions
 pénales, concernant la remise aux autorités judiciaires,
 lorsque celles-ci la demandent, de la transcription en
 clair des documents chiffrés. De même, les capacités
 techniques des pouvoirs publics seront significativement
 renforcées et les moyens correspondant dégagés.

 (- complement the current legal system with new 
 enforced obligations about the delivery to legal authorities
 on demand of cleartext transcripts of enciphered documents.
 Likewise the technical facilities of the authorities will be
 strengthened.)

 Changer la loi prendra plusieurs mois. Le
 Gouvernement a voulu que les principales entraves qui
 pèsent sur les citoyens pour protéger la confidentialité
 de leurs échanges et sur le développement du commerce
 électronique soient levées sans attendre. Ainsi, dans
 l'attente des modifications législatives annoncées, le
 Gouvernement a décidé de relever le seuil de la
 cryptologie dont l'utilisation est libre, de 40 bits à 128
 bits, niveau considéré par les experts comme assurant
 durablement une très grande sécurité.

 (To change the law will take some months. The Government
 has wanted that the main hindrances which put a lot of weight
 on the ability of citizens to protect the confidentiality of their
 exchanges and on the development of the electronic business
 are lifted without wait. Then, in wait of announced upgrade of
 the law, the Government has decided to raise the threshold for
 free use ciphers from 40 bit key length to 128 bits, a level
 which should give for a long time a very good security according
 to experts.)

PPS: my comments:
the French law separates:
 - authentication/integrity/digital signature, ...
 - low security ciphers (threshold on key length) or
   ciphers with trusted third party
 - high security ciphers
and
 - usage, supply, export and
   import from a country outside the European Union.
The speech is only on usage, not on supply then as usual
it is not clear it is an effective progress.
The value of threshold on key length is not in the law, only in a decree:
the Government can change it tomorrow (which is a good point)
and usually the proceedings for supply, export and import use
the same threshold (ie the Government can abolish most of the current
law only with a new application decree which takes only the time to
publish it).
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------