javax.crypto is subject to export controls; what does that mean?

Question

According to http://docs.oracle.com/javase/6/docs/technotes/guides/security/overview/jsoverview.html:

For historical (export control) reasons, the cryptography APIs are organized into two distinct packages. The java.security package contains classes that are not subject to export controls (like Signature and MessageDigest). The javax.crypto package contains classes that are subject to export controls (like Cipher and KeyAgreement).

What does this mean?
What is the difference?

Note: This document reference is quoted in Java EE doc in security section >> http://docs.oracle.com/javaee/6/tutorial/doc/bnbwj.html | is this ref outdated ?

Answer 1

The first thing to note is that the text you quoted starts 'for historic reasons'.

The USA had export controls over some cryptographic algorithms and implementations above certain key lengths. They were mostly dropped during the Clinton administration: certainly those that affected Java. Any reference you read to them in reference to Java cryptography is obsolete.

Java is however affected by crypto import policies, and that's why the Unlimited Strength Crypto Policy download exists. If it's legal in your jurisdiction, you can download and install it. All it does is enable code that is already present in the JRE and which therefore has already been exported. QED