Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 2 down vote favorite
1

I am currently using AESManaged encryption for my silverlight application. Does AESManaged encryption have a severe trade compliance issue in Bureau of Industry and Security in terms of shipping the application internationally?

share|improve this question

2 Answers

up vote 1 down vote

If your software provides encryption, then you have to go to BIS, even if you're using a third-party framework that was approved by BIS, including Windows APIs.

This is what Apple's Mac App Store requires, even though Mac developers are using Mac OS X built-in encryption approved by BIS; so I trust Apple's lawyers here.

share|improve this answer
up vote 2 down vote

I am tempted to say that AESManaged is a class provided by the framework, i.e. you do not ship it: it is already shipped. Then whatever compliance issue may exist is to be handled (and has been handled) by Microsoft, not you.

(I am not entitled in any way to give legal advice, so do not take my word for it.)

share|improve this answer
Whatever compliance issue with AESManaged has been handled by Microsoft. But his code may have its own compliance issues. BIS doesn't care that his code uses AESManaged, they're not interest in the how. But if the what is encryption, they are very interested in what it does. (And it goes the other way too. For example, if he has his own AES code, but only uses it to secure licenses, then BIS doesn't care that he has encryption code because he doesn't provide an encryption function.) – David Schwartz Dec 29 '11 at 8:21
@DavidSchwartz - in other words, there might be an issue if somebody would open up a general use encryption function to the user of the application? Can we have a link to the actual text? – owlstead Dec 29 '11 at 18:27
@owlstead what test are you looking for? The law? or are you asking if you can provide a link to decrypted text? – Chad Dec 29 '11 at 21:15
@owlstead If the code provides encryption functions (whether intentionally by design, or 'accidentally' by exposing an API that it only uses for non-encryption purposes but that can be used for encryption purposes), then you have an issue. – David Schwartz Dec 30 '11 at 2:24
@David, the code provides encryption function. Can you please elaborate the issue? – xscape Jan 2 '12 at 5:43
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.