ITAR and hardware crypto - Page 1
Forum section: electronics / general

author: ajb
author_rank: Super Contributor
timestamp: July 25, 2014, 05:39:51 pm
content: First of all, let's set aside discussion of the efficacy or propriety of import/export restrictions; the laws are what they are and let's leave it at that.It seems there are an awful lot of MCUs available these day that incorporate hardware crypto modules, and as far as I can tell these are all swept up in the vague net of restrictions that comprise ITAR in the US. In particular they would fall under classification 5A002: "Systems, equipment, electronic assemblies, and integrated circuits for information security. Reasons for Control: NS1, AT1".What I'm curious about is if one were to use such an MCU in a product with some benign, non-restricted purpose, would the finished product wind up being restricted as a result? Would any distinction be drawn based on whether the device incorporates but does not use crypto hardware, or uses crypto hardware (say, for signed firmware updates) but does not expose cryptographic functions to the end user, or actually allows the user to encrypt/decrypt arbitrary data?Obviously I'm not looking for a legal opinion here, I'm just curious if anyone has any experience with using such parts in products that are exported from the US and if they'd be willing to share some insight. Aside from the law itself which is incredibly vague and a few official statements issuing narrow guidance on very particular cases there seems to be very little in the way of authoritative or first-hand information on the web.

author: AndyC_772
author_rank: Super Contributor
timestamp: July 25, 2014, 07:27:15 pm
content: I think it's exporting stuff from the US that's the problem - even if it was originally imported into the US from the country being exported to.

author: KJDS
author_rank: Super Contributor
timestamp: July 25, 2014, 07:36:24 pm
content: Quote from: AndyC_772 on July 25, 2014, 07:27:15 pm^^^This^^^The worst grief I ever had was getting some ICs out of the US for a product being built in the UK. The end user? The US navy.

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: July 25, 2014, 07:37:51 pm
content: I was just going to say exactly same thing - just manufacture it is China or Hungary or wherever you feel like and ship it directly from there so that no export/import in/out of US involved and problem is solved.

author: zapta
author_rank: Super Contributor
timestamp: July 25, 2014, 08:34:26 pm
content: I doubt if placing an ITAR component within a larger product removes its ITAR restrictions. Otherwise it creates very obvious loophole, install a nuclear bomb trigger in a fridge and export to the DPR.

author: G0HZU
author_rank: Super Contributor
timestamp: July 25, 2014, 09:14:37 pm
content: I'm not an expert on this stuff by any means but if our company uses an ITAR component (eg an ITAR restricted transistor or amplifier) anywhere in a system then we have to conform with a whole load of export rules and restrictions when we sell or loan out the system or take it overseas for a demo.It doesn't matter what the system does, even if it's something totally benign. We are tied to strict export restrictions. So the obvious answer is to not use ITAR parts for certain products.

author: zapta
author_rank: Super Contributor
timestamp: July 25, 2014, 10:02:48 pm
content: Digikey should have a itar attribute in it's parametric search, similar to led-free.

author: N2IXK
author_rank: Frequent Contributor
timestamp: July 25, 2014, 10:11:15 pm
content: I had to purchase a Krytron trigger tube from EG+G (now Perkin-Elmer) years ago for repairing a piece of laser gear and had to fill out all kinds of end use documentation, ITAR certifications that the unit was not being exported, etc.For those not familiar with them, they are very fast high energy switch tubes which are just the ticket for high speed flashlamp drivers in lasers, as well as for firing detonators in nuclear weapons.http://en.wikipedia.org/wiki/Krytron

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: July 25, 2014, 11:30:47 pm
content: I have seen some of the discussions about these restrictions on webs few times. Whole thing often sounds kind of ridiculous and outdated. Like it imposes export restrictions on certain components that made sense in 1950, but now with modern rate of technological progress most of it sounds more like if China would have restricted sales of gun powder to Europe since year 1281. I have read ridiculous stories about export restrictions from radio astronomers that were building equipment for observatory in Chile. For some reason most government's regulations always sound retarded when it comes to technologyI am talking about all governments not any particular one.

author: zapta
author_rank: Super Contributor
timestamp: July 26, 2014, 12:31:52 am
content: Quote from: Alexei.Polkhanov on July 25, 2014, 11:30:47 pmWeb discussion of ITAR always focuses on the negative side effects so we don't get a balanced opinion about its merits.

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: July 26, 2014, 04:14:36 am
content: This is true. Nobody would go and start writing on forums about what a wonderful thing export restrictions areStill I am not aware of anything positive that comes out from it. Just lots of hustle and useless paperwork.

author: zapta
author_rank: Super Contributor
timestamp: July 26, 2014, 06:12:36 am
content: Quote from: Alexei.Polkhanov on July 26, 2014, 04:14:36 amWell, maybe without ITAR, every ISIS jihadist would have now high quality night vision goggles. The internet gives you only one side of the story.

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: July 26, 2014, 07:03:04 am
content: Right, hahaha, I never heard of ISIS, but then I read your reply I Googled "ISIS night vision goggles" and I found that this is a well funded organization that ... image below.http://rollingout.com/news/isis-new-terror-group-iraq-block/#_

author: zapta
author_rank: Super Contributor
timestamp: July 26, 2014, 01:57:35 pm
content: Quote from: Alexei.Polkhanov on July 26, 2014, 07:03:04 amIt's not a all or nothing thing. Less is better.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: July 26, 2014, 02:25:10 pm
content: The problem is that the people who set these rules move at least an order of magnitude slower than the technology.Bad guys will always find ways to get stuff.

author: bwat
author_rank: Frequent Contributor
timestamp: July 26, 2014, 02:35:48 pm
content: Quote from: mikeselectricstuff on July 26, 2014, 02:25:10 pmSometimes they just ignore their own rules: Iran-Contra.Anyway, if it can be used for nefarious purposes it can be probably be bought from one of the German speaking Swiss cantons.

author: zapta
author_rank: Super Contributor
timestamp: July 26, 2014, 04:55:06 pm
content: Quote from: mikeselectricstuff on July 26, 2014, 02:25:10 pmIt's the same for bike theft but I lock mine nevertheless.I think that as a white hat electronics practitioner you are more exposed to the negative aspects of ITAR.

author: abaxas
author_rank: Regular Contributor
timestamp: July 26, 2014, 09:07:56 pm
content: Why would the 'bad guys' need all this tech,when they have a massive technological advantage in their basic weaponary?