Is discussion of cryptography allowed?

The answer seems to be that it isn't, but the resources are pretty confusing. My legal background is limited to two courses in Dutch health care law (one of those covering a slightly broader array of legal topics). It seems this is not enough for me to understand what is going on here, nor does there seem to be a good resource to refer users who are posting questions about cryptography.

I have read the Wikipedia page, which made me fall deep into the rabbit hole pretty fast (I stopped when I was reading US federal code definition documents). The Wiki page and the documents it links to read like a lot of things are illegal to discuss (as that results in publishing and therefore export of software).

However, a search of Answers turns up many threads where cryptography is discussed. Some have an accepted answer, but other also mentions of personal experiences and indications that more detail would not be allowed. One of the most confusing threads in my opinion is this one, where a lot of details are provided in a discussion, but also some content has been removed for (fear of) violating the export restriction.

What is the closest we can get to a short answer about what is allowed and what isn't? I am aware a definitive answer would probably require the legal team from Mathworks to answer this thread (and maintain it after any rule change). Seeing as that is unlikely, I'm hoping for any input that helps me better judge which question to close/ignore and which can be answered.

Answer 1

[Image Analyst]

I pretty much just ignore them all. I mean, it's not my project, so why should I expose myself to any risk? If I don't answer, there is no risk to me. It's not my responsibility to answer/solve their question. Don't feel you need to answer every question out there that you can answer. It's within your right to not answer a question, even if you know the answer. I don't answer every image processing question, even if I know the answer, not because of legal reasons but just because sometimes it would take hours of explanation and hand holding. Anyone interested in teaching a semester long course in Fourier theory to a novice who needs it so the solution to his question can be understood? Not me. I know some people at the Mathworks are pretty hands off unless a complaint is made, while others are more "by the book", so whether changes are made by them to File Exchange submissions or Answers posts may depend on who saw it.

Now there are some gray areas. Like what about watermarking, especially invisible watermarking to detect image theft or in forensics? When does watermarking cross the line from encoding to encryption. What is steganography? Is it encoding or is it encryption?

[Rik]

Thank you for your comments.

For myself it isn't really the need to answer everything, but more a question of which question I should close. As a recent example: this one. This user has posted two previous questions, which were both closed for cryptography reasons (if I recall correctly). Apart from all the other issues with this question, I don't think the poster is really aware why his questions are being closed. I suppose questions like those is what flagging is for.

Answer 2

[Walter Roberson]

The USA does not have an absolute ban on discussion of cryptography or posting of cryptography programs.

• in cases where posting of cryptography programs is permitted, the person who posted the cryptography program must immediately thereafter report the posting to the appropriate branch of the US government.
• Although the reporting onus is on the person doing the posting, then because arguments can be made that matlabcentral does not fall within the "Safe Harbor" provisions of US law, there are legal arguments that Mathworks might be considered the "publisher" for legal purposes, and that therefore Mathworks could be liable for posted cryptography programs that were not prompty reported by the author. This is a legal risk that is mitigated by Mathworks saying that such postings are not permitted
• the USA regulations generally permit discussion of encryption when the keyspace is no more than 56/64 bits (many 64 bit encryption techniques involve stuffing the MSB of 7 bytes into an 8th byte to get 64 bits with the top bit clear in each byte)
• For discussion with larger key spaces, the person must actively get permission for the discussion from the appropriate branch of the US government before the discussion happens.
• Major difficulty: the discussion of even small key-space encryption requires prior permission if users can readily extend the key space beyond 56/64 bits.

This bit about possibility to extend is a big PITA, because about the only encryption technique that cannot be readily extended to larger key spaces is the null encryption whose output is the unchanged source.

Every time I notice someone posting ROT13, I have to close the discussion, because ROT13 is a Caeser Cipher example that is very easily extended to arbitrary large keyspaces. Extending ROT13 to use a key of 'MATHWORKS' would result in a cipher that would require prior permission to discuss.

So legally speaking, it would be possible for Mathworks to permit discussion of small key space techniques, but only in one of the two situations:

1. The program contains obvious and fundamental bugs that would prevent it from ever working as a successful encryption program -- not just small implementation bugs like an off-by-one that someone might be able to fix: it would have to be theoretical errors that make the program useless; or
2. The program is so long and complex and obscure as to make it impractical for most people to understand and so it exceeds the required level of modification difficulty to make it work with longer key spaces

In practice, this means that they occasionally permit a sufficiently ugly program in the File Exchange, but that they cannot really permit encryption discussion.

So... why can encryption discussions be found in practice in Answers:

• Mathworks doesn't read every posting. They hope one of the volunteers will close or flag encryption discussions. None of the volunteers read every posting either. Things get overlooked.
• the boundaries between watermarking and steganography are rather blury.
• The legal restraints are on encryption specifically. Not on mathematical techniques that could potentially be used for encryption. For example function out256 = incr(in); out=mod(in+1,256); could potentially be used in the context of a Caeser Cypher. If the poster were to say that they wanted to do a Caeser Cypher we would have to block the posting. But it is a basic mathematical technique that has other uses. Elliptic Curves have other uses than just cryptography, so a question about Elliptic Curve compution is not inherently a question about cryptography. We aren't required to ask about intended use of everything.

Answer 3

[Bruno Luong]

How those US regulations would matter for foreign participants like me?

I'm not under those restriction or I'm I?

If the answer is no, then there is no reason to close a thread when it's asked by a foreign person.

If you guys in US can't answer by law, then let us do our own disucssion.

Isn't that work like this?

Note that I can come here through the french page of TMW.

[Rik]

I don't know why Stephen deleted his comment, but that is indeed the reason: the terms of use specify that the laws of Massachusetts apply. So even if we as European citizens are in conversation, the laws apply to the medium, not the people.

[Walter Roberson]

The servers are considered to reside in the USA. Mathworks uses (or used) Akamei infrastructure to mirror some of the UI work and document serving to local servers in other countries, but those local servers are under the control of the US servers.

In order for the US regulations to not apply, any cryptography discussion created inside of the USA could not be accessed outside the USA (using protections stronger than just changing your Country on the Mathworks site; VPNs would probably have to be blocked as well). Likewise, Mathworks would have to detect cryptography discussions created outside the USA and prevent them from being stored in the USA infrastructure.

My understanding is that some of the cryptography discussion infrastructures on the internet have taken the time to work through the technical mechanisms implied but the USA laws (and the relevant laws of other countries), but it is not easy to get right.

[Bruno Luong]

I don't care how it's stored, this technical detail is not my concern. Nobody tells me where and how the server is located and I as user don't have to care.

I'm come from a french Mathworks site, read the Terms, and didn't see anything that prevent me to discuss about cryptography, which - in my country - is permitted by law. T formally agree with the Term of TMW and sign in.

So I can go to a disccusion Answers board I post a cryptography question, reply to a cryptography question postes by someone else.

Now if TMW infringes the law by archiving, storing my discussion and they are unable to do so because they are in Massachusetts and this is prohibited by US law, fine the discussion might be erased or not properly archived, this I can understand and don't ask otherwise.

However nothing prevent me to post a content and participe to a discussion with cryptography. I'm not under US law.

[Walter Roberson]

There are no technical blocks to posting questions about cryptography, but Mathworks or the moderators will remove them or close them as they are found, because of the USA legal requirements.

I am not in the USA, but I cannot discuss cryptography because of Canadian laws (the relevant Canadian laws do generally permit discussion of cryptography, but I have to be able to prove that all people who have access to the discussions are physically inside Canada.)

[Bruno Luong]

So the right response for me is

Yes the discussion is allowed if the participants is not US, Canadian, [add here other country citizenship ...], However it can be removed without notice

BTW In the Central Term Of Use, TMW states "MathWorks has no obligation to monitor the Content. ", so they can as well not remove the discussion and it's normal one can still found the discussion of cryptography in the archive.

[Walter Roberson]

Okay, Bruno, I will get the Terms and Conditions changed to officially reflect the cryptography ban.

Cryptography discussions are prohibitted here, as per multiple private communications with Mathworks. I remove them as soon as I find them.