Using hash functions to bypass Cold War-era crypto export restrictions

Question

During the Cold War and up until late 1992, export restrictions prevented the distribution of strong cryptographically secure ciphers. These export restrictions required that all symmetric ciphers be capped at a small enough key size that they could be feasibly cracked by US intelligence agencies. In order to avoid running afoul of these regulations, the Linux kernel used cryptographic hashes for generating random data. Since it seems there were no restrictions on the security of hash algorithms, and as it is technically possible to create a symmetric cipher using a hash algorithm, would it have been legal to export such a system without it being classified as munitions?

Given that I'm asking on Law.SE rather than Crypto.SE, a few notes on terminology:

A hash function is an algorithm which takes an arbitrarily-sized input and generates an output digest of a fixed size, such as 160 bits. They are designed such that any small change in the input creates a wildly different output. A secure hash function is designed so knowledge of the output digest is not sufficient to deduce what the input was. Secure hashes of the time, such as MD5, had this property.

A pseudorandom number generator, or PRNG is an algorithm that takes a small random seed, and deterministically expands it into an endless stream of pseudorandom data. The same seed will always result in the same psueodrandom output, and small changes to the seed result in completely different output. A cryptographically-secure PRNG is designed such that the seed cannot be determined based on knowledge of the output, and future output cannot be predicted without access to the seed.

A symmetric cipher is an algorithm which takes a key of a given size, and uses that key to scramble input data. The output of the cipher is unreadable unless the same exact key is used to decrypt it. A stream cipher is a type of symmetric cipher based on a secure PRNG, using the seed as the key and combining the output (keystream) with the data to be encrypted using an invertible operation such as XOR. The data can then be decrypted by repeating the process on the encrypted data, with the key.

Answer 1

To answer my own question:

Since it seems there were no restrictions on the security of hash algorithms, and as it is technically possible to create a symmetric cipher using a hash algorithm, would it have been legal to export such a system without it being classified as munitions?

It seems that this particular loophole was actually the subject of the famous Bernstein v. United States court cases. Bernstein had noticed this loophole himself and wished to published a paper which contained the specifications for an encryption algorithm, "Snuffle", which uses a hash function at its core. This algorithm later became Salsa20 and is now often used in the form of the quite-popular modified version, ChaCha20, currently gaining traction in HTTPS encryption.

From the introduction in the design documents for Bernstein's Snuffle:

Fifteen years ago, the United States government was trying to stop publication of new cryptographic ideas - but it had made an exception for cryptographic hash functions, such as Ralph Merkle's new Snefru. This struck me as silly. I introduced Snuffle to point out that one can easily use a strong cryptographic hash function to efficiently encrypt data.

The results of the court cases was that cryptography was protected speech:

Bernstein ultimately filed this action, challenging the constitutionality of the ITAR regulations.  The district court found that the Source Code was speech protected by the First Amendment, see Bernstein v. U.S. Department of State, 922 F.Supp. 1426 (N.D.Cal.1996) (“Bernstein I” ), and subsequently granted summary judgment to Bernstein on his First Amendment claims, holding the challenged ITAR regulations facially invalid as a prior restraint on speech, see Bernstein v. U.S. Department of State, 945 F.Supp. 1279 (N.D.Cal.1996) (“Bernstein II” ).