Re: Fw: Question about Export Control of Gnumeric

[Nick Lamb <njl tlrmx org>]

On Wed, 2008-11-12 at 08:30 -0500, Morten Welinder wrote:
> > Does Gnumeric have an encryption function, or function
> > to use another software having encryption, such as SSL?
>
> Yes.  The excel plugin contains something for reading encrypted
> xls files.

Microsoft Excel has gone through several generations of differing types
of encryption.

The encryption used up until Excel 95 is flimsy due to poor design. You
can download a program I wrote which outputs the correct unlocking
password in the blink of an eye on an ordinary personal computer, it is
XOR based and frankly might as well be ROT13.

The next generation from Excel 97 onward, still used by default in the
last Excel version I tried, is a little harder, it uses RC4, and
Gnumeric does implement it. Applications to break it are available for a
small fee. It appears that a reasonable brute force effort is sufficient
to break the key without revealing the password used.

Finally, newer versions of Excel use a Windows crypto layer to offer
many other varieties of cipher and so on. But I don't think Gnumeric
supports any of these ciphers and they aren't used by default in Excel
when I last checked. 

In theory Gnumeric when exported from the US is probably subject to
this:
http://www.bis.doc.gov/encryption/default.htm

But those regulations are basically crazy, and the big list of
exemptions shows that they've been repeatedly found to be unworkable.
Somewhere online there should be records of Mozilla.org's attempts to
figure out what they needed to do about this.

If someone really /likes/ bureaucracy they should volunteer to either
figure out if Gnumeric qualifies for an exemption or submit Gnumeric
through this "review" process for export.

Nick.