EspreSSL

2) Another project called PureTLS was released a while back which meets several of the goals of the EspreSSL project. This guy also seems to have more balls than I do about releasing export controlled software on the net without verification.

3) I got tired of worrying about export control laws and patent problems with RSA. EspreSSL was in the right all the way, but if someone felt like making my life miserable they probally could have since I don’t like long court battles. I felt the best way to deal with this was leave the code and binaries down, but this does not facilitate Open Source development.

The main goal of the project was to provide the world with a free, open and pure Java SSL toolkit. Others have done this so I lost interest in the project since the goal was met (albiet by someone else).
With that in mind, with the expiration of the RSA patent coming up in September and new laws about export from the US being forged as we speak, the project could come back to life. If this were to happen, I would be refocusing on making EspreSSL a 100% open provider of JSSE services since Sun was nice enough to make an API for us. I will post this message to the web site so other people can know what is going on.

Legal

I think the best way to do this is as a Q & A session. So, here goes:

Q1: I notice you are in the U.S. and therefore subject to export laws. How can
you write crypto software and distribute it?

A1: I can write crypto software inside the U.S. to my hearts content,
but I cannot distribute it outside the U.S. Right now EspreSSL is not downloadable
for this very reason. The only way to get at the source is to send me an e-mail
with a request for CVS access. I will then send back an application including things
such as home address and phone number to be sure that you are in the U.S.

Q2: SSL uses RSA, which is patented. How can you write SSL without licensing RSA?
A2: EspreSSL does not actually contain any crypto code. The way that it works
is that someone who wants to use EspreSSL would have to plug in their own
implementation for all the crypto algorithms. In the case of RSA, this could be
in the form of a licensed toolkit from RSA. EspreSSL supports the JCE 1.2 standard, so
anyone who has a JCE 1.2 compliant crypto provider will be able to plug it right
in with no hassle. In other words, EspreSSL by itself is worthless until you
plug in the crypto code. Another alternative is to not use RSA, but to use
Diffie-Hellman, which is also supported. Diffie-Hellman is patent free and
offers similar security to RSA.

Q3: Isn’t a U.S. only SSL implementation worthless to the global community?
A3: Yes, but, when EspreSSL has reached a 1.0 level of quality I hope to
be able to export it legally. I have two options, the first
is to deal with the export administration and have EspreSSL deamed exportable.
The second is to export it in the same way that PGP is currently exported. On
paper. The export administration guidelines for crypto export do not restrict the
export of cryptographic code on paper. This is my least favorite option and
is to be avoided if possible. Even if it does turn out to be the only
option, it will require much research and a better understanding of the
export laws.

Q4: If it’s so difficult to do this inside the U.S. why don’t you let
someone else outside the U.S. do it so you won’t have to worry about
all these restrictions?

A4: Well, the fact is that noone was (or is) doing it when I started
the project. I saw the need for something like this, and decided to
do it. I would be more than happy to shut this project down the second
I found out that someone else had made a freely available Java SSL implementation.

Download

If you are interested in the source code for EspreSSL you can download it below. Please keep in mind that the project is unfinished and abandoned, the code is useful for nothing more than study and I will not answer any questions about it. With that:
The current version of the EspreSSL source code is available here

Library

Team