Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a very similar question to the one asked here (regarding Iran). However, I would like to use ssh and vpn while being in India. I found already this survey of cryptographic laws but I don't understand the implications for ssh and VPN.

Additionally it would be helpful to know whom to ask in the country. Do you think the embassy or a lawyer would know?

Many thanks in advance.

share|improve this question
add comment

4 Answers

up vote 7 down vote accepted

Professor Koops's excellent summary says that ssh and VPN are legal to use and bring into the country, but that you are required to provide your passwords and encryption keys to the authorities if they ask for them.

However, as a general rule, you should trust neither my nor the Professors advice and instead consult a lawyer, in India, who specializes in this area.

(Your lawyer in your own jurisdiction will have ways to find one.)

share|improve this answer
    
I wonder how that affects a DH / ephemerally keyed session. –  Jeff Ferland Mar 22 '12 at 16:45
    
Ah, the specific wording of the law is carefully vague: basically, if the cops tell you to decrypt your data, you either do it, whatever that involves, or spend the next 7 years in prison. –  Graham Hill Mar 27 '12 at 10:10
    
Not sure if applicable here, but legislation tends to differentiate between stored data and data in transit. –  Legolas Mar 28 '12 at 14:03
add comment

Using Ssh and VPN may not be legal in India. It is better to consult a good cyber lawyer in India in this regard.

Kindly refer to Encryption Policy Of India Is Needed.

Further, you may consult Perry4Law in this regard if stakes are high.

share|improve this answer
add comment

It may not be allowed to use ssh and VPN in India as on date.

It is only now that India is considering raising the encryption level to 128 bits. It means for the time being you cannot use more than 40 bits encryption in India.

Asking the embassy would not serve your purpose. Get the help of some good Indian lawyer of your choice in this regard.

share|improve this answer
    
For reference, can you cite the law/regulation that restricts encryption to 40 bits? I've had a quick look at the IT Acts of 2000 and 2008 and don't see it, although of course IANAL. –  Graham Hill Mar 28 '12 at 10:31
add comment

Graham IT Act 2000 is still silent on encryption issue as Indian government has not formulated the necessary guidelines in this regard u/s 84A of IT Act 2000.

The restriction is flowing from the rules and regulations issued by the department of telecommunication (DOT) in this regard.

However, this is a bad method as now such rules of DOT are being challenged in courts and Indian parliament.

share|improve this answer
    
All the more reason to consult a good local lawyer with experience in this area... –  Graham Hill Mar 28 '12 at 13:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.