In Reader to Reader: "56-Bit vs. 128-Bit Encryption Service" (March 2001, InstantDoc ID 19624), Sharon Leibel states that 128-bit encryption isn't legally allowed outside the United States. However, this restriction was lifted on January 14, 2000, when the new US encryption export regulations took effect. The new regulations state that US-generated cryptology can be exported to nongovernment entities and to commercial government-owned entities (except those that produce munitions), in countries excluding the following: Afghanistan (formerly Taliban-controlled areas), Cuba, Iran, Iraq, Libya, North Korea, Serbia (except Kosovo), Sudan, and Syria. Unless Sharon is in one of these countries, she can update to 128-bit security for all her applications.
—Ken Fallon
ken_fallon@hotmail.com