encryption software in iphone and export laws

Question

encryption software in iphone and export laws

When uploading software to app store, it ask

"Export laws require that products containing encryption be properly authorized for export.
Failure to comply could result in severe penalties"

My question
If the program uses encryption libraries already included in the iphone, such as the stuff in
<CommonCrypto/CommonDigest.h>
<CommonCrypto/CommonCryptor.h>

, in my example rc4, what should be the correct answer to apple. My code does not include
encryption, but it support encryption.

It would be great if someone at Apple could answer. I cannot be the only one having this problem.
I have previous asked Apple, but after a month and resending the mail, I have given up. Guess they are very busy at the moment

Mac OS X (10.5.4)

Posted on Aug 4, 2008 11:21 AM

Reply

Answer 1

robhedin

Level 2

355 points

Aug 4, 2008 12:08 PM in response to Jan Frydendal

The response I received from Apple legal on the same topic was "yes you have to have appropriate CCATS document on file even if you're using CommonCrypto". Went round and round for a bit on it, and still disagree but am not willing to risk the potential headache.

rob.

Reply

Answer 2

Aug 4, 2008 12:21 PM in response to robhedin

did Apple tell you how to get the source code from these CommonCrypto parts. They are part of the OS, and I have only the include files.

I do not think we can only send the include files to BIS, and ask for a legal document.

Again, anyone from Apple reading this discussion. Please give advice

I also have a program using the NSStreamSocketSecurityLevelNegotiatedSSL on a socket, in other words telling the OS, to run SSL on the socket. Is this also a violation of the export rules, or am I missing something.

Reply

Answer 3

Aug 4, 2008 12:41 PM in response to Jan Frydendal

So, also md5 will fall into this case ?

Reply

Answer 4

Aug 4, 2008 4:15 PM in response to maurodelrio

Hashing is not encryption, it's a one way function.

Encryption is something you can decrypt, either with a symmetric key or a public/private key like RSA.

Reply

Answer 5

Aug 4, 2008 8:26 PM in response to blazespinnaker

This is holding me up as well.
The 742.15(b)(1) and (b)(2) are complicated as ****.
You have to get SNAPR registered apply online do all kinds of crap.
I see some apps are using "built in" 256bit AES.
Did these guys go through this approval? how long did it take them?
I'm hobbling my app to 64bits until I can get through all the crap that
this export stuff requires.

It would be GREAT if someone could write down all the steps that it
takes so others can follow. I'm just NOW starting to beat my head
against this brick wall, but I am recording all the steps and durations.

Scott
btw: I'm told even if I did a rot13 I'd have to get reviewed. Even a simple
ceasar cipher. Kind of a joke, I think. I've read two sides of the coin, one
that this is basically unenforceable and two, they're so anal that they will
come after you even for a rot13. Of course, I don't need the ADDITIONAL
government headache, so I'll continue to bleed from the ears until something
gets approved. Lets see, 10 apps... will need to get reviewed... lovely.
I figure BIS is gonna know me on a first name basis pretty soon.

Reply

Answer 6

Aug 5, 2008 2:14 AM in response to Jan Frydendal

The source code to CommonCrypto is available here: http://www.opensource.apple.com/darwinsource/10.5.4/CommonCrypto-32207/

I'm not sure if it's the same version as in the iPhone OS, but seeing as the CommonCrypto source code has not changed since the release of Leopard, it probably is.

Reply

Answer 7

Sep 27, 2008 4:47 PM in response to Jan Frydendal

Does anyone have an opinion, and/or experience with an application that uses SSL?

I want to encrypt a credit card. The purchase is not for a hard good, but instead for a (legitimate) service based in the US only.

None of the sales transactions would involve anyone outside the country. Well, it might, but it would be the equivalent of paying for a cab ride in New York. If your not in the cab, whats the point of encumbering the charge.

Reply

Answer 8

Yeti234

Level 1

0 points

Oct 9, 2008 2:47 AM in response to ScottYelich

Hi Scott,

did you get through already? It seems I have to go through this as well (at least only for one app), so it would be interesting to hear if it worked out for you.

Cheers,
Michael

Reply

Answer 9

johnTu

Level 1

0 points

Feb 5, 2009 12:07 PM in response to Jan Frydendal

Does this thing continue?

So i have to send login informations to server as plaintext?
Is this meaningful?

If i can not use encryption in my iphone app, how to do some certain things...

Reply

Answer 10

Aug 3, 2009 1:45 PM in response to ScottYelich

We just posted a detailed, practical guide to obtaining mass market encryption commodity classification for iPhone applications:

http://www.zetetic.net/blog/2009/08/03/mass-market-encryption-commodity-classifi cation-for-iphone-applications-in-8-easy-steps/

It covers all the steps and forms required by SNAP-R and even includes templates for supporting documents like the introductory letter of explanation and technical specification.

Reply