HP chairman, CEO, and president Lewis Platt said the International Cryptology Framework (ICF) will remove a significant barrier to conducting electronic commerce on the Internet. It also would allow U.S. software companies to make a single version of their software to be used both domestically and overseas.
With ICF, strong encryption could be built into software and hardware devices but disabled on versions that are exported. When a user switched on software in Europe, for example, the software would check with a clearinghouse to determine what level of encryption could be used. The clearinghouse could detect the user's location and issue appropriate instructions.
ICF does not solve policy debates over what level of encryption can be exported, but it does provide a flexible framework that can accommodate changes as policies evolve.
"We have provided a framework that lets customer have best, strongest encryption available at any point in time," Platt told a Washington, D.C., press conference.
Intel also said it would manufacture and distribute hardware that will include the ICF technology, which is based on RSA Data Security encryption. Also backing the framework are Netscape Communications, Oracle, Informix, VeriFone, and smart card manufacturer Gemplus.
In addition to preliminary backing by the State Department, HP said the governments of France and England also endorsed ICF.
Among the ICF elements are the following:
A hardware-based system is inherently more secure than software, experts say, because it is harder for hackers to circumvent.
HP will design and license ICF and enable many of its products to support the framework. Products using an ICF cryptography unit can be exported to most locations without restrictions or controls, the company said. HP said the first products based on ICF would become available next year.
HP's Platt said the ICF initiative does not conflict with an IBM-led effort to create a "key recovery" system that would comply with U.S. export regulations.
On Friday, President Clinton issued an executive order liberalizing those export controls if the products include a key that lets government decode messages after receiving a court order or similar authorization. Without a key, strong encryption still cannot be exported.
HP said it will open up its architecture for external review.