There are many different cryptography laws in different nations. Some countries prohibit export of cryptography software and/or encryption algorithms or cryptoanalysis methods.
In some countries a license is required to use encryption software, and a few countries ban citizens from encrypting their internet communication. Some countries require decryption keys to be recoverable in case of a police investigation.
Issues regarding cryptography law fall into four categories:
- Export control, which is the restriction on export of cryptography methods within a country to other countries
or commercial entities. There are international export control agreements, the main one being the Wassenaar Arrangement. The Wassenaar Arrangement was created after the dissolution of COCOM (Coordinating committee for Multilateral Export Controls), which in 1989 "decontrolled password and authentication-only cryptography."
- Import controls, which is the restriction on using certain types of
cryptography within a country.
- Patent issues, which deal with the use of cryptography tools that are
- Search and seizure issues, on whether and under what circumstances, a
person can be compelled to decrypt data files or reveal an encryption
Restrictions on the import of cryptography
Countries may wish to restrict import of cryptography technologies for a number of reasons:
- Cryptography may increase levels of privacy within the country beyond
what the government wishes.
- Citizens can anonymously communicate with each other, preventing any
external party from monitoring them.
- Encrypted transactions may impede external entities to control the
conducting of business.
- Imported cryptography may have backdoors or security holes,
intentional or not, which allow foreigners to spy on persons using
the imported cryptography; therefore the use of cryptography is
restricted to that which the government thinks is safe, or which it
The Electronic Privacy Information Center and Global Internet Liberty Campaign reports use a color code to indicate the level of restriction, with the following meanings:
- Green: No restriction
- Yellow: License required for importation
- Red: Total ban
Here is List of Countries, each with their level of import restrictions.
and List of Countries with their import/export restrictions details and explanation
Import Limits on Cryptographic Algorithms in Java
Due to import regulations in some countries, the Oracle implementation provides a default cryptographic jurisdiction policy file that limits the strength of cryptographic algorithms.
If stronger algorithms are needed (for example, AES with 256-bit keys), the JCE Unlimited Strength Jurisdiction Policy Files must be obtained and installed in the JDK/JRE.
It is the user's responsibility to verify that this action is permissible under local regulations.