Ira points out that the Federal government has raised the limit from 40 bits
(3 minutes to crack on a PC) to 56 bits (2 months). He also suggests that
we shouldn't even get into this. Refer the reader to TLS.
So replace:
It is possible that due to certain government export restrictions some
non-compliant versions of this extension could be deployed. Implementations
wishing to inter-operate with such non-compliant versions MAY offer the
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA mechanism. However, since 40 bit
ciphers are known to be vulnerable to attack by current technology, any
client which actives a 40 bit cipher MUST NOT indicate to the user that the
connection is completely secure from eavesdropping.
with:
See the TLS specification [RFC2246] for any government export restrictions
on implementations conforming to the "Mandatory Cipher Suites".
Tom Hastings
(310) 333-6413