Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

UPDATE: Apache Foundation matrix classifies all their software as ECCN 5D002 and exports it under TSU exception in EAR 740.13(e). The OpenSSL Software Foundation went the same route.

That said, I now have to figure out whether a closed source software, that uses an open source crypto library, can as well be exported under the EAR 740.13(e) exception or there is another exception, that applies.

Thank you in advance.

share|improve this question
Afaik public domain is exempt from export regulation. Nacl is in the public domain. – CodesInChaos Aug 21 '13 at 15:32
But most likely your product which uses NaCl needs permission. Luckily the process has become much simpler over the last few years. It's little more than an online questionaire nowadays. – CodesInChaos Aug 21 '13 at 16:27

I believe that Sodium, as an open source project, qualifies for section (e) of the TSU exemption to export controls:

(I'm not a lawyer, but this is what is used by the Apache foundation for cryptography-related code, as I understand it.)

share|improve this answer
What I remember is that open source requires notification to some institution and public domain doesn`t even require that. – CodesInChaos Aug 21 '13 at 15:35
Thank you. I'm going to update my question with what I've discoved so far based on your Apache lead. – portnoy Aug 22 '13 at 2:55
I'd also like to leave the link to the recent §734.3 document here – portnoy Aug 22 '13 at 3:24

I wouldn't worry about it. The US export regulations on Software is an ancient practice, originating from before the Internet. In addition, with this last year's NSA revelations, the US has lost any international leverage to this kind of regulation abroad. So if this still worries you, just register a shell/subsidiary company in Europe and you can sell your stuff.

share|improve this answer
No part of this answer is actionable. – schroeder Feb 25 '14 at 21:52
That's what happens, when you're not able to comment before getting 50 credits. It was meant as a comment to OP. So thanks for down-voting. – user1147688 Feb 26 '14 at 14:49
Comment or answer makes no difference. Bad advice all around. Encryption export controls are maintained by international agreements and are not US-specific. – schroeder Feb 26 '14 at 17:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.