We’re rewarding the question askers & reputations are being recalculated! Read more.
3 grammar fix
source | link

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, sodiumSodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

UPDATE: Apache Foundation matrix classifies all their software as ECCN 5D002 and exports it under TSU exception in EAR 740.13(e). The OpenSSL Software Foundation went the same route.

That said, I now have to figure out whether a closed source software, that uses an open source crypto library, can as well be exported under the EAR 740.13(e) exception or there is another exception, that applies.

Thank you in advance.

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, sodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

Thank you in advance.

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

UPDATE: Apache Foundation matrix classifies all their software as ECCN 5D002 and exports it under TSU exception in EAR 740.13(e). The OpenSSL Software Foundation went the same route.

That said, I now have to figure out whether a closed source software, that uses an open source crypto library, can as well be exported under the EAR 740.13(e) exception or there is another exception, that applies.

Thank you in advance.

    Tweeted twitter.com/#!/StackSecurity/status/370065366820855808
2 added 39 characters in body
source | link

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryptionNaCl for encryption (well, sodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

Thank you in advance.

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, sodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

Thank you in advance.

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, sodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

Thank you in advance.

1
source | link

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, sodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

Thank you in advance.