RSA Key Length and Export Restrictions

Question

I know there are many restrictions on the length of the key used (import and export restrictions for almost every country). It usually ranges from 64 to 256 bits. To use more bits, you need to ask permission from the authorities.

But it is recommended to use 1024 bits for RSA at least! Does this mean that I can’t just use RSA without any legal problems, etc.?

Answer 1

Limitations of the bit length in the 64-bit range are implicitly associated with symmetric cryptographic. Usually, to limit asymmetric crypto-like RSA (for example, relaxation of export controls in the USA in 1998 it was allowed to export symmetric cryptographic encryption up to 56 bits and asymmetric cryptography up to 1024 bits), separate bit length restrictions are usually used.

RSA 64-bit encryption will be interrupted in minutes in less than a second.

Answer 2

In Special Publication 800-57, NIST recommends using 1024-bit RSA keys to protect data until 2010.

Answer 3

I'm not a lawyer (IANAL), but if your application uses an external library or built-in OS service, restrictions on exporting to the USA for cryptography do not require an in-depth analysis of your code and algorithms. The MSCrypto library that ships with the Windows operating system was written out by Feds for export (although its capabilities may be limited in some geopolitical regions), so applications that use the MSCrypto DLL functions do not need to go through an exhaustive review.

I was part of the release cycle of several retail products that used MSCrypto to generate keys and encrypt / decrypt data, and most of all we needed to do to satisfy US export restrictions by filling out a form in which it was announced that we used MSCrypto, key sizes which we used, and for what purpose.

If you implement the crypto algorithm on your own or statically link the crypto code in your exe or dll (and not a separate DLL), and your software will be sold outside the United States (you do not need to sell it), you will most likely need to provide a detailed overview of your code and / or algorithms to get rejected from export.