Did US prohibit the export of the mere description of a cryptographic algorithm?

Question

A Wikipedia page says that in the US

regulations were introduced as part of munitions controls which required licenses to export cryptographic methods (and even their description)

What concrete evidence is there that the US banned the export of e.g. books on cryptography or similar descriptions of encryption methods. Surely they could have kept some algorithms from becoming public even in the US (as state secrets), but that's not what I'm talking about, but rather something that was ok to circulate e.g. in book form in the US, but banned from export (as a book) e.g. to the USSR or Iran, etc. Are there such examples?

There's no evidence of this kind that I can see on that wiki page.

Answer 1

Part 121

The United States Munitions List Enumeration of Articles

Sec. 121.1 General. The United States Munitions List.

...

Category XIII--Auxiliary Military Equipment ...

(b) Information Security Systems and equipment, cryptographic devices, software, and components specifically designed or modified therefore, including:

(1) Cryptographic (including key management) systems, equipment, assemblies, modules, integrated circuits, components or software with the capability of maintaining secrecy or confidentiality of information or information systems

...

f) "Software" includes but is not limited to the system functional design, logic flow, algorithms, application programs, operating systems and support software for design, implementation, test, operation, diagnosis and repair.

Answer 2

Actually, it looks like books with crypto algorithms were excluded from such exporting licensing requirements; in the Karn case:

The ODTC [Office of Defense Trade Controls] determined that the book, which contained the algorithms in printed form, was not subject to its export jurisdiction because it was in the public domain. However, the information on the floppy disk (which was identical to that in printed form in the book) was nonetheless subject to its jurisdiction because it was in the form of source code and thus considered a functional commodity. Karn was therefore required to register as an arms dealer and obtain an export license for the material on the floppy, but he was able to freely export the book.

Even though it was the same information, the material on the floppy was considered technical information because it did not meet the definition for a public domain exception under ITAR.

And how the regs defined that

Sec. 120.18 Public domain.

Public domain means information which is published and which is generally accessible or available to the public:

(a) Through sales at newsstands and bookstores;

(b) Through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information;

(c) Through second class mailing privileges granted by the U.S. Government; or,

(d) At libraries open to the public.

[...]

PART 125

LICENSES FOR THE EXPORT OF TECHNICAL DATA AND CLASSIFIED DEFENSE ARTICLES

Sec. 125.1 Exports subject to this part.

(a) The export controls of this part apply to the export of technical data and the export of classified defense articles. Information which is in the "public domain" (see Sec. 120.18) is not subject to the controls of this subchapter.

Answer 3

Have a look at the case Bernstein v. United States

In the early 1990s, Daniel J. Bernstein created the Snuffle encryption system. He wanted to publish it in an international conference. However, after asking the appropriate US department, he was told by the Office of Defense Trade Controls:

the information known as Snuffle 5.0 has been determined, under the Commodity Jurisdiction (CJ) determination process, to be a defense article

requiring him to register as an arms manufacturer. After much back and forth, he ended up suing in February 1995 (the basis being that the export-control laws were unconstitutional). Government lawyers claimed that his claim [that he was restrained from exporting it] was unfounded, “the product of his own misinterpretation of the facts and the ITAR.”

On its decision, the District Court stated that

plaintiff had every reason to believe his paper had been determined to be a defense article

So we can conclude from the District Court ruling that the US did prohibit the export, even though the ITAR later backed out and claimed they didn't.

There was a lot of requesting information, not receiving an answer, or hardly applicable ones. One of the funny pieces of the Court decision was:

Defendants also conclude summarily that both the definition of cryptographic software and the exemptions from this definition are clear to a person of ordinary intelligence. This seems to be a bit of dissimulation, unless it is a confession, since the ODTC itself mistakenly classified Bernstein's academic paper as a defense article under Category XIII.

The ruling in the case declared that software was protected speech under the First Amendment. It is to note that export rules changed and now it is now allowed to export a cryptographic algorithm, even in digital form.

You can read the documents of the case at Daniel Bernstein page https://cr.yp.to/export.html including the multiple documentation involved.