          Copyright (c) mjh-EDV Beratung, 1996-1999
     mjh-EDV Beratung - 63263 Neu-Isenburg - Rosenstrasse 12
          Tel +49 6102 328279 - Fax +49 6102 328278
                Email info@mjh.teddy-net.com

    Author: Jordan Hrycaj <jordan@mjh.teddy-net.com>

   $Id: README.RESTRICTED-KEY-LENGTHS,v 1.8 2000/01/17 08:26:00 root Exp $

   This library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Library General Public
   License as published by the Free Software Foundation; either
   version 2 of the License, or (at your option) any later version.

   This library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Library General Public License for more details.

   -----------------------------------------------------------------

Important:
  
  This file applies only in rare cases, as when this library
  needs to placed on a US server that can be downloaded from
  the rest of the world.

  And this makes only sense if this library comes as support for
  another package.

   -----------------------------------------------------------------

In order to satisfy us export laws, you can restrict the session
key lengths to 56, or 64 bits (or_whatever_you_want mod 8). To do
that, append the key length to the --enable-cipher argument when
configuring:

  ./configure --enable-cipher=64

To meet some weird export restrictions concerning assymetric keys,
you can also set the maximal El Gamal key size to, 512 say

  ./configure --enable-cipher=64,512

Compiling now produce a cipher library instance with the following
features:

+ all assymetric keys greater than 512 bits are rejected

+ all session keys are restricted to effectively using 64 bits,
  only (the rest of the keys is fixed)

+ you need to install the same peks library instance on the
  server and on the client machine (two different library
  instances cannot communicate)

So, for US exporting (and testing) you can use the 64 bits
restricted version to provide ready-to-use binaries.  At the
destination you may recompile the peks library without any
encryption restriction.

   -----------------------------------------------------------------

I hope this way of dealing with export laws is a usefull feature,
please comment.

Send bugs, ideas, suggestions and the like to
<jordan@mjh.teddy.net.com>.

jordan

