I am currently using AESManaged encryption for my silverlight application. Does AESManaged encryption have a severe trade compliance issue in Bureau of Industry and Security in terms of shipping the application internationally?


I am tempted to say that AESManaged is a class provided by the framework, i.e. you do not ship it: it is already shipped. Then whatever compliance issue may exist is to be handled (and has been handled) by Microsoft, not you.

(I am not entitled in any way to give legal advice, so do not take my word for it.)

  • $\begingroup$ Whatever compliance issue with AESManaged has been handled by Microsoft. But his code may have its own compliance issues. BIS doesn't care that his code uses AESManaged, they're not interest in the how. But if the what is encryption, they are very interested in what it does. (And it goes the other way too. For example, if he has his own AES code, but only uses it to secure licenses, then BIS doesn't care that he has encryption code because he doesn't provide an encryption function.) $\endgroup$ Dec 29 '11 at 8:21
  • $\begingroup$ @DavidSchwartz - in other words, there might be an issue if somebody would open up a general use encryption function to the user of the application? Can we have a link to the actual text? $\endgroup$
    – Maarten Bodewes
    Dec 29 '11 at 18:27
  • $\begingroup$ @owlstead what test are you looking for? The law? or are you asking if you can provide a link to decrypted text? $\endgroup$
    – Chad
    Dec 29 '11 at 21:15
  • $\begingroup$ @owlstead If the code provides encryption functions (whether intentionally by design, or 'accidentally' by exposing an API that it only uses for non-encryption purposes but that can be used for encryption purposes), then you have an issue. $\endgroup$ Dec 30 '11 at 2:24
  • $\begingroup$ @David, the code provides encryption function. Can you please elaborate the issue? $\endgroup$
    – xscape
    Jan 2 '12 at 5:43

If your software provides encryption, then you have to go to BIS, even if you're using a third-party framework that was approved by BIS, including Windows APIs.

This is what Apple's Mac App Store requires, even though Mac developers are using Mac OS X built-in encryption approved by BIS; so I trust Apple's lawyers here.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.