V-ONE breaks through encryption export barrier

GERMANTOWN, MD. - A small security vendor, V-ONE Corp., broke through the U.S. government's en-cryption export barrier, receiving Commerce Department approval to ship its virtual private network gear (VPN) almost anywhere in the world.

Companies will be able to use V-ONE's SmartGate VPN, which uses strong Triple-Data Encryption Stan-dard (DES) encryption, in about 140 countries without having to go through a case-by-case approval process.

V-ONE cut through the red tape because its SmartGate VPN for enterprise application encryption uses a trusted first-party key-re-covery meth-od that the FBI and Na-tional Security Agency (NSA) approved after more than a year of evaluation.

V-ONE re-ceived approval by providing a way for companies using SmartGate to decrypt data at the request of law enforcement - without the encryption user surrendering his private key. Analysts predict the rest of the security industry will have to heed the regulatory victory.

"Other vendors are going to have to follow suit here to get the same type of approval in order to remain competitive," says Jeffrey Johnson, president and CEO of Meta Security Group in Alpharetta, Ga. "The vendors are tired of being limited by these government rules."

And so, of course, are users. Government encryption regulations have often hindered corporations from using the same products internationally that they use at home, which jeopardizes network security and confounds interoperability.

How did V-ONE get this unprecedented break from the Department of Commerce? The SmartGate client/ server-based VPN has a feature called KRAKit, which allows designated corporate employees to decrypt application data encrypted with SmartGate.

This differs from the trusted third-party approach pushed by the FBI and NSA, which would require a corporation to escrow encryption keys with an outsider.

"We looked at the regulations, and met with the Bureau of Export Controls and the FBI repeatedly," says Dave Dawson, V-ONE's CEO. "We came up with what we call the trusted first-party mechanism, whereby a company can 'recover' its own keys, should law enforcement require access to data."

With the Commerce Department's approval, V-ONE becomes the only security vendor with Triple-DES encryption, which can be easily exported to most countries by any type of organization - not just banking, insurance or others that have special privileges under the export rules.