During the Cold War and up until late 1992, export restrictions prevented the distribution of strong cryptographically secure ciphers. These export restrictions required that all symmetric ciphers be capped at a small enough key size that they could be feasibly cracked by US intelligence agencies. In order to avoid running afoul of these regulations, the Linux kernel used cryptographic hashes for generating random data. Since it seems there were no restrictions on the security of hash algorithms, and as it is technically possible to create a symmetric cipher using a hash algorithm, would it have been legal to export such a system without it being classified as munitions?

Given that I'm asking on Law.SE rather than Crypto.SE, a few notes on terminology:

A hash function is an algorithm which takes an arbitrarily-sized input and generates an output digest of a fixed size, such as 160 bits. They are designed such that any small change in the input creates a wildly different output. A secure hash function is designed so knowledge of the output digest is not sufficient to deduce what the input was. Secure hashes of the time, such as MD5, had this property.

A pseudorandom number generator, or PRNG is an algorithm that takes a small random seed, and deterministically expands it into an endless stream of pseudorandom data. The same seed will always result in the same psueodrandom output, and small changes to the seed result in completely different output. A cryptographically-secure PRNG is designed such that the seed cannot be determined based on knowledge of the output, and future output cannot be predicted without access to the seed.

A symmetric cipher is an algorithm which takes a key of a given size, and uses that key to scramble input data. The output of the cipher is unreadable unless the same exact key is used to decrypt it. A stream cipher is a type of symmetric cipher based on a secure PRNG, using the seed as the key and combining the output (keystream) with the data to be encrypted using an invertible operation such as XOR. The data can then be decrypted by repeating the process on the encrypted data, with the key.

  • You may be interested in Chaffing and Winnowing – Damien_The_Unbeliever Feb 22 at 12:25
  • @Damien_The_Unbeliever That's certainly interesting, but it seems only to be useful for two parties communicating. Encryption can be used for many other things, like securing personal data. – forest Feb 22 at 23:10
  • I don't suppose you have a copy of the text of the old restrictions? – D M Feb 22 at 23:11
  • I do not. I looked for them but didn't find anything that I could be certain were laws from that era. I believe symmetric ciphers were limited to 64 bits domestically, and 40 bits internationally? Something like that. – forest Feb 22 at 23:13
  • The idea "Since the basic pieces are not restricted, the result is not restricted" seems troubling to me; in the end the "basic pieces" of all the algorithms are basic operations that are not restricted, yet some of those results are restricted... I certainly would want to check the "final product" against the letter of the law. – SJuan76 Feb 22 at 23:39
up vote 0 down vote accepted

To answer my own question:

Since it seems there were no restrictions on the security of hash algorithms, and as it is technically possible to create a symmetric cipher using a hash algorithm, would it have been legal to export such a system without it being classified as munitions?

It seems that this particular loophole was actually the subject of the famous Bernstein v. United States court cases. Bernstein had noticed this loophole himself and wished to published a paper which contained the specifications for an encryption algorithm, "Snuffle", which uses a hash function at its core. This algorithm later became Salsa20 and is now often used in the form of the quite-popular modified version, ChaCha20, currently gaining traction in HTTPS encryption.

From the introduction in the design documents for Bernstein's Snuffle:

Fifteen years ago, the United States government was trying to stop publication of new cryptographic ideas - but it had made an exception for cryptographic hash functions, such as Ralph Merkle's new Snefru. This struck me as silly. I introduced Snuffle to point out that one can easily use a strong cryptographic hash function to efficiently encrypt data.

The results of the court cases was that cryptography was protected speech:

Bernstein ultimately filed this action, challenging the constitutionality of the ITAR regulations.  The district court found that the Source Code was speech protected by the First Amendment, see Bernstein v. U.S. Department of State, 922 F.Supp. 1426 (N.D.Cal.1996) (“Bernstein I” ), and subsequently granted summary judgment to Bernstein on his First Amendment claims, holding the challenged ITAR regulations facially invalid as a prior restraint on speech, see Bernstein v. U.S. Department of State, 945 F.Supp. 1279 (N.D.Cal.1996) (“Bernstein II” ).

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.