During the Cold War and up until late 1992, export restrictions prevented the distribution of strong cryptographically secure ciphers. These export restrictions required that all symmetric ciphers be capped at a small enough key size that they could be feasibly cracked by US intelligence agencies. In order to avoid running afoul of these regulations, the Linux kernel used cryptographic hashes for generating random data. Since it seems there were no restrictions on the security of hash algorithms, and as it is technically possible to create a symmetric cipher using a hash algorithm, would it have been legal to export such a system without it being classified as munitions?

Given that I'm asking on Law.SE rather than Crypto.SE, a few notes on terminology:

A hash function is an algorithm which takes an arbitrarily-sized input and generates an output digest of a fixed size, such as 160 bits. They are designed such that any small change in the input creates a wildly different output. A secure hash function is designed so knowledge of the output digest is not sufficient to deduce what the input was. Secure hashes of the time, such as MD5, had this property.

A pseudorandom number generator, or PRNG is an algorithm that takes a small random seed, and deterministically expands it into an endless stream of pseudorandom data. The same seed will always result in the same psueodrandom output, and small changes to the seed result in completely different output. A cryptographically-secure PRNG is designed such that the seed cannot be determined based on knowledge of the output, and future output cannot be predicted without access to the seed.

A symmetric cipher is an algorithm which takes a key of a given size, and uses that key to scramble input data. The output of the cipher is unreadable unless the same exact key is used to decrypt it. A stream cipher is a type of symmetric cipher based on a secure PRNG, using the seed as the key and combining the output (keystream) with the data to be encrypted using an invertible operation such as XOR. The data can then be decrypted by repeating the process on the encrypted data, with the key.

  • You may be interested in Chaffing and Winnowing Commented Feb 22, 2018 at 12:25
  • @Damien_The_Unbeliever That's certainly interesting, but it seems only to be useful for two parties communicating. Encryption can be used for many other things, like securing personal data.
    – forest
    Commented Feb 22, 2018 at 23:10
  • I don't suppose you have a copy of the text of the old restrictions?
    – D M
    Commented Feb 22, 2018 at 23:11
  • I do not. I looked for them but didn't find anything that I could be certain were laws from that era. I believe symmetric ciphers were limited to 64 bits domestically, and 40 bits internationally? Something like that.
    – forest
    Commented Feb 22, 2018 at 23:13
  • 1
    Note that MD5 is built from a block-cipher with a 512-bit key. Commented Feb 23, 2018 at 16:05

1 Answer 1


To answer my own question:

Since it seems there were no restrictions on the security of hash algorithms, and as it is technically possible to create a symmetric cipher using a hash algorithm, would it have been legal to export such a system without it being classified as munitions?

It seems that this particular loophole was actually the subject of the famous Bernstein v. United States court cases. Bernstein had noticed this loophole himself and wished to published a paper which contained the specifications for an encryption algorithm, "Snuffle", which uses a hash function at its core. This algorithm later became Salsa20 and is now often used in the form of the quite-popular modified version, ChaCha20, currently gaining traction in HTTPS encryption.

From the introduction in the design documents for Bernstein's Snuffle:

Fifteen years ago, the United States government was trying to stop publication of new cryptographic ideas - but it had made an exception for cryptographic hash functions, such as Ralph Merkle's new Snefru. This struck me as silly. I introduced Snuffle to point out that one can easily use a strong cryptographic hash function to efficiently encrypt data.

The results of the court cases was that cryptography was protected speech:

Bernstein ultimately filed this action, challenging the constitutionality of the ITAR regulations.  The district court found that the Source Code was speech protected by the First Amendment, see Bernstein v. U.S. Department of State, 922 F.Supp. 1426 (N.D.Cal.1996) (“Bernstein I” ), and subsequently granted summary judgment to Bernstein on his First Amendment claims, holding the challenged ITAR regulations facially invalid as a prior restraint on speech, see Bernstein v. U.S. Department of State, 945 F.Supp. 1279 (N.D.Cal.1996) (“Bernstein II” ).

  • So where does this leave things? The Wikipedia article says that, although the rules have been "relaxed", crypto is still strictly regulated and sometimes requires registration and licensing. Also, it's still illegal to export crypto to US enemies such as Iran and North Korea. Do hashing algorithms currently fall under these regulations or don't they? Commented Feb 27, 2019 at 19:20
  • @ThrowAwayAccount I don't think hash algorithms ever did. The point was that encryption was regulated, but hashes (which are unregulated) could be trivially used to implement strong encryption.
    – forest
    Commented Mar 21, 2021 at 22:35
  • But if a "hashing algorithm" can be used to implement strong encryption, then it's not a hashing algorithm, it's a strong encryption algorithm. Commented Aug 3, 2021 at 8:24
  • @ThrowAwayAccount All strong hashing algorithms can be used to implement strong encryption, and vice versa. However they fall legally, under cryptography they are still separate.
    – forest
    Commented Nov 12, 2021 at 20:31
  • 1
    @ThrowAwayAccount They aren't the same thing. A hash is a surjection that takes a variable-length input and produces a fixed-length output. A block cipher (a common class of encryption algorithms) is a family of permutations where actual permutation is selected by a fixed key, meaning the resulting fixed-length input and fixed-length output are bijections.
    – forest
    Commented Nov 12, 2021 at 21:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .