Mr Peter Gutmann
24 Durness Place
Orewa
AUCKLAND
Dear Mr Gutmann,
Thank you for your letter of 8 April 1997 on the topic of encryption. We understand your confusion on whether you would need to apply for an export permit if you felt that a product fell beneath 40-bit.
Our policy is as follows. As category 5 part 2 (information security) of New Zealand's export controls indicate, all exports of encryption are screened. Encryption products vary widely in design, functionality, and cryptographic strength. As all cryptographic products are potentially dual-use in nature [1] it is important that each type be assessed before granting an export permit or, indeed, excepting a good from the requirement of applying for an export permit if it is found to be suitable to do so.
As you know, the strength of encryption algorithms is dependant on several factors; the key length, the type of algorithm (symmetric or asymmetric) and how efficiently the key is utilised. In addition, its potential for diversion depends on the extent of its integration in the host application. Consequently, each case requires individual consideration although some of the specifically defined algorithms (eg 40-bit RC4, 512-bit RSA) may be cleared without recourse to an evaluation[2].
Therefore it is the responsibility of the Ministry in its capacity as the licensing authority - rather than the exporter - to assess whether an encryption export falls outside the threshold of requiring an export permit.
In answer to your last query, this will continue to apply to future exports as well. Of course, export controls will continue to evolve and the requirements for export may change with time.
We have streamlined the export approval as much as possible [3]. It so happens that the field you are interested in is a complex one. But normally export permits applications[sic] are processed very simply [4]. There are not, at present, any plans to alter the above requirements.
Yours sincerely
John Borrie
for Secretary of Foreign Affairs and Trade
[2] Is there anyone who still doubts that the NSA is running our trade policy?
From this statement it is New Zealand government policy that New Zealand
companies use proprietary and/or patented technology owned by a privately-held
US firm in order to obtain any cooperation from the US^H^HNew Zealand
government. Astounding.
[3] They keep making this claim. I do not think it means what they think it
means.