Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I wonder, if I am allowed to develop an SSH client for distribution through Apple App Store without breaking any export regulations? I don't really know much about the encryption algorithm. Below is a screenshot from App Store:

enter image description here

share|improve this question

closed as off-topic by Lucas Kauffman, NULLZ, Gilles, Xander, AJ Henderson Jul 3 '13 at 13:18

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Sorry, we don't deal with specific legal questions here. –  Manishearth Jul 3 '13 at 9:28
4  
This question appears to be off-topic because it is about legal advice. –  Lucas Kauffman Jul 3 '13 at 10:33

1 Answer 1

up vote 4 down vote accepted

This falls under the Wassenaar Arrangement / COCOM (Coordinating Committee for Multilateral Export Controls) for Sweden:

Since 1 January 1995, Sweden restricts export of encryption according to the Wassenaar Arrangement, including the General Software Note. This regulation refers to the EU regulation (1334/2000) instead of maintaining a national list of controlled goods. The relevant regulations are the Law on control of dual-use goods and of technical assistance (SFS 2000:1064) of 30 November 2000, and the corresponding Decree (SFS 2000:1217)

Then it goes on to limit certain restrictions:

A Foreign Affairs press release of 23 June 1999 announced that as of 1 August 1999, the Inspection for Strategic Products has the power to proclaim rules for general export licenses for crypto products. The general export license published (TFS 1999:40, 1 July 1999) allows crypto exports of up to 128-bit symmetric mass-market crypto to a list of about 60 approved countries:

Argentina, Australia, Bahrain, Bangladesh, Brazil, Bolivia, Brunei, Bulgaria, Canada, Chechnya, Chile, China, Cyprus, Ecuador, Egypt, Estonia, Hong Kong SAR, Hungary, Iceland, India, Indonesia, Israel, Japan, Jordan, Kuwait, Latvia, Lebanon, Lithuania, Macao SAR, Macedonia, Malaysia, Mauritius, Mexico, Morocco, New Zealand, Norway, Oman, Pakistan, the Philippines, Poland, Qatar, Rumania, Russia, Saudi Arabia, Singapore, Slovakia, Slovenia, South Africa, South Korea, Sri Lanka, Switzerland, Taiwan, Thailand, Tunisia, Turkey, Ukraine, the United Arab Emirates, Venezuela, Vietnam.

Transport within the European Union is not considered export, so any crypto transfer is allowed. For other countries and products, an individual license is required.

And here is the Sweden's May 1999 Government Communication 1998/99:116 On cryptography.

Short answer: Yes.

The rest is then in the two documents I linked to. It's a bit lengthy read I'm afraid, but the Apple Store asks these questions for the reason of limiting product sales to those countries that laws and regulations of exporting countries might prohibit. In short, follow the questionnaire upon publishing your application, and the restrictions need to be followed by the App Store, not you.


The application process paper the documentation links to is sadly dead, so I dug around a bit to see what authority authorises export of cryptography products in your country:

Edit to add: If, however, your product's encryption strength isn't excluded from these export restrictions, or you need to acquire a licence to export to other countries that aren't implicitly listed as allowed to export cryptography products to, then in your case (Sweden), the national authority handling decisions on matters concerning licensing of the production and export of "dual-use" products (including: advanced technology machine tools, chemicals, encryption and navigation equipment, heat exchangers and pumps, but also knowledge, software and training material) is the ISP (Swedish Agency for Nonproliferation and Export Controls). That would be my first contact of choice, if you require obtaining export licence for your product and you also plan on selling your solution to other, not listed countries.

share|improve this answer
    
And it can be exported to other countries? and is a license required? –  David Karlsson Jul 3 '13 at 9:37
1  
@DavidKarlsson - Please see my updated conclusion. Best would be to read through those documents I've linked to, but my conclusion based on reading parts of it pertaining to your country, and most of it pertaining to mine with some projects I was involved with before, suggests there's barely any differences there and seems to be much the same for all EU countries. Subtle differences might exist though, so please refer to the documentation. –  Noordung Jul 3 '13 at 9:43
    
found this tutorial on getting an ERN (Encryption Registration Number) –  David Karlsson Jul 3 '13 at 10:05
    
@DavidKarlsson - I'm not entirely sure that form is meant to be used by any publisher outside US and this line certainly doesn't read as such: "Your submission will be used to determine whether it meets the US government’s Export Administration Regulation (EAR) criteria for a mass market encryption item." It's from this blog post that the one you link to references. –  Noordung Jul 3 '13 at 10:11
    
ITunes Connect requires an ern on publishing a cryptohraphic app. It is in the next step of the questionnaire. –  David Karlsson Jul 3 '13 at 11:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.