A working group of respected cryptographers recently announced that 56-bit keys are insecure and that keys of at least 90 bits are required to secure information for the next 20 years. Currently, regulations promulgated under the Arms Export Control Act and the International Emergency Economic Powers Act, as well as the International Traffic in Arms Regulations, hold back the use of strong encryption. There are no restrictions on the domestic use of strong encryption technology, but until recently, encryption software that uses a key length of more than 40 bits could not be exported without special permission. In the fall of 1996 the Clinton administration announced that it would allow companies to export key lengths of up to 56 bits, under licenses reviewed every six months, if the companies agreed to produce key recovery plans within two years. After two years, nothing stronger than 40 bits will be exportable without key recovery features.
Export controls interfere with the marketing and sale of powerful encryption technology.
Software makers must develop one product for sale nationally and another for sale internationally, which is often prohibitively expensive. In developing a product for international sale, they must choose between two unpalatable and unprofitable options. The first is to sell a product internationally that offers only weak cryptographic protection. Export controls have severely hampered U.S. software companies' serving world markets for encryption software. Export controls violate the First Amendment.