Export Restrictions on Cryptography in the USA

While sourceforge is hysterical , let's read US laws on export restrictions. For example ECCN 5D002 , about which everyone has heard, but no one read.



The United States authorizes the export of software without restriction and review if all of the following items are met:

• The code is subject to export restrictions ECCN 5D002
• The code is publicly available.
• Notification sent to US Government’s Bureau of Industry and Security (BIS)

Open-source programs automatically fall under the second point. But what is item number one? Now let's try to figure it out.

It covers:

• Software designed for the development, modification or any other use of the software from this list ; or
• Software with a symmetric cipher longer than 56 bits; or
• Software with an asymmetric cipher using the decomposition of an integer into prime factors with a key length of more than 512 bits (for example, RSA); or software using computations of discrete logarithms over a finite field or other operations on discrete algorithms with a key length of more than 112 bits (for example, elliptic curves).
• Software for cryptanalysis.

It is expressly stipulated that packaging and coding do not fall under this act.

3. “Cryptography” does not include “fixed” data compression or coding techniques.

Hash functions are not cryptographic algorithms with symmetric / asymmetric keys in general, so they are not even considered.



From publicly available software, after such filtering, there remain American browsers, in which these restrictions have always been a special software like TrueCrypt.

More can be read on apache.org .