[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Export control of SHA

>
>   Companies or individuals who plan to use the SHA implementation
>   inside their product(s) need not obtain a separate export license
>   for reexporting SHA as long as the same guideline on the original
>   license is followed. For information or clarification on this
>   issue, please call BXA at (202) 482-4811.
>
>Shu-jen,
>	If the text of the original export license which NIST has
>obtained for the export of SHA could be obtained in electronic form,
>could you please post a pointer to it?  I suspect it would be of great
>interest to many implementors on this list.
>

Unfortunately the export license NIST obtained from the Commerse Department
is not available in electronic form nor self-explanatory. The license contains:

1. Export Control Classification Number: 5D13A (this is the reference number
for making inquiries). In fact,

    5 - indicates the "Telecommunications and Cryptography" category. 
    D - software
    01 - 19: Coordinating Committee Controls
         (others are:
            20-39: Missile Technology Controls
            40-59: Nuclear Non-Proliferation Controls
            60-79: Chemical and Biological Weapons Controls
            80-99: Other Controls)
    A - a data processing code to indicate the country group for which a
Validated License is required

2. General license eligibility: GTDR, GLX

        GTDR(General License Technical Data Restricted) is the code for the
free world countries.

        GLX is the code for countries where SHA can only be imported for
non-military usage.

3. Validated License Required for Country Groups: All

The license also contains the following footnotes:

Commodities eligible for export under General License and used in the
design, development, production or use of Nuclear, Chemical or Biological
weapons or ballistic missiles require a Validated export license.

The countries included in each Country Group are listed on the reverse side
of this form (Not copied for this email message). For shipments of the above
commodities to any of the destinations indicated in the validated license
required column (meaning the item 3 above), the exporter must apply for and
obtain a validated license document from the Office of Exporter Services, P.O.
Box 273, Washington, D.C. 20044.

When an export is made, it is necessary for the exporter to show on the
Shipper's Export Declaration (Form 7525-V), either the validated license
number or the applicable general license symbol (e.g., GLV, G-DEST, etc.).
Form 7525-V is available from the Superintendent of Documents, U.S.
Government Printing Office, Washinton, D. C. 20402, and from Export
Administration District Offices (U.S. Dept of Commerce). They may also be
obtained from certain commercial stationers.

For Information concerning this classification (i.e. 5D13A) contact 
        Gustaf A. Sundquist 
        Phone: 202 482-1265

Above is the information contained in NIST's export license, granted on
8/17/1995.

>	I don't quite understand what you mean by "the same guidelines
>on the original license".  In the context of your message, that could be
>interepreted as "anywhere except the embargoed countries, plus civilian
>use only for China and former Soviet Bloc countries", or it could imply
>there were other restrictions on the original license.
>

Your first interpretation was exactly what I meant to convey. I have called
BXA to confirm this interpretation. For example, if country A exports SHA to
country B under the general license GTDR, and country B later on wants to
export SHA to country C, country B does not need a separate license as long
as country A can export to country C under the original license.

When Eduardo Chen sends out the SHA code upon request, he will attach a memo
basically saying something similar to what I summarized in yesterday's message. 

I hope this long message is useful to most of you.

>
>P.S.  I do think NIST should be commended in its proactive role in
>obtaining an export license for SHA which could be used by other
>companies or individuals who are contemplating using SHA in their
>products. 
>

Thank you, service is our name:-).

Shu-jen