ance could be instigated not only by benign' governments, but also by a range of private parties who would inevitably penetrate the back-doors of such systems, not to mention other governments and entities (either now or in the future) who most decidedly won't be benign in nature."
There are many good sources of up-to-date information on the calls for increased restrictions on encryption that started after the September 11, 2001 terrorist attacks, including:
For more general information on the public policy aspects of encryption see "Links to further resources, focusing on encryption politics" in the following section.
We've listed some useful sites below. Bulleted subsections denote the page's focus and particularly useful resources. Items marked with an asterisk (*) are for readers interested in the more technical workings of encryption.
Cryptography at Electronic Frontiers Australia
Cryptography FAQs at FAQs.org
Links to technical resources for advanced encryption users
If you need to know more about a specific topic, try searching for it from your favorite Web search site.
Many programs and algorithms used for security purposes are not available outside of the United States because of U.S. export law. Some policy makers are now calling for increased restrictions on the use of encryption in response to the September 11, 2001 terrorist attacks on the World Trade Center and the Pentagon. Before acquiring or using any encryption software, you will need to make sure that it is legal to use in your location. In most cases, this information will be included in the licensing agreement. When downloading or installing software, read the licensing agreements. For the software reviews in this guide, we've tried to ascertain whether the programs are available outside of the U.S., but ultimately it's up to you to determine whether a given program is legal to use where you live. Some of the links provided below may help.
Bureau of Export Administration Encryption Export Regulations, houses all encryption rules published by BXA since export control jurisdiction was transferred from the State Department to the Commerce Department in 1996. At the time this guide was published, the most recent update was in October 2000.
Electronic Frontier Foundation's Crypto Export archive (contains political articles, discussions, and notes).
Information Security and Privacy in Network Environments (lengthy Sept. 1994 political report; use your browser's Search or Find function with the text "Government Policies and Cryptographic Safeguards" to find the relevant chapter).
RSA Laboratories' FAQ about Today's Cryptography: United States Cryptography Export/Import Laws (particular note of interest: reports on the legality of RSA and Triple-DES export).
U.S. Department of Commerce / The Bureau of Export Administration / Office of Strategic Trade and Foreign Policy Controls / Information Technology Controls Division / Commercial Encryption Export Controls.
Defined below are some of the terms used throughout this guide. For a more comprehensive look at cryptography terms, try some of the following sites:
Follow the link from the term to read more about it (often on another site).
A Block Cipher is a method for encrypting data in chunks (several or many contiguous bits) as opposed to encoding bit-by-bit like a stream cipher. (More information.)
A Stream Cipher is a method of encrypting data bit-by-bit, as opposed to encoding a contiguous chunk of data all at once like a block cipher. (More information.)
Acronyms and terms that you have encountered in this guide that are not listed here may be encryption standards or algorithms. For more information please see Appendix B: What are the different kinds of algorithms that encryption software programs utilize?
As discussed in section 5, "What are the vulnerabilities in encryption and how do I guard against them?," "brute force" cracking is a method of finding a password or key by trial and error. The longer the password or key, the more difficult it becomes to crack it. For example, a 56-bit key has 256 possibl