I have a steganography application that uses one-time-pad encryption. Obviously, key lengths can be very long.

If I were to limit the sales market on the Microsoft Store to U.S. only, would that be sufficient action to relieve the application of any Export Admin Regulation? Or, would it still be subject to other forms of regulation?

Any direction or feedback is appreciated as I find the BIS regulations rather confusing. I'm bureaucratically challenged :)

  • $\begingroup$ How do you generate your one time pads? If you're putting short keys into your PRNG then you should be okay. $\endgroup$ – Paul Uszak Nov 3 '17 at 17:41
  • 1
    $\begingroup$ The application has a one-time-pad utility which uses a 640x480 noise palette image containing 575 complete sets of color intensities from 0 to 255. Looks like static on an old tv screen. Color values are read as the user moves the cursor over the noise palette. For generating larger files, extra color samples are taken in a random 'cloud' about the cursor. These are saved as one-time-pad files. $\endgroup$ – Dean Westfeld Nov 3 '17 at 17:58
  • $\begingroup$ If you're storing ‘one-time pads’, you're probably wasting your storage. Sensible one-time pads are generated by feeding 256 bits chosen uniformly at random, e.g. with CryptGenRandom on Windows, to a modern stream cipher like ChaCha. This system is fast and cheap, needs no more than 32 bytes of storage, and is well understood by the worldwide crypto community. You could hash the CryptGenRandom output together with your television screen readout—but it won't substantively change anything unless CryptGenRandom is more disastrously broken than I expect. $\endgroup$ – Squeamish Ossifrage Nov 4 '17 at 1:54
  • 1
    $\begingroup$ I'm voting to close this question as off-topic because this is not about cryptography as defined in our help center. In the end, we’re not lawyers and this site is not the optimal place to get such legal advice. For questions like these, asking a legal pro would be preferable – or, you could try asking at law.stackexchange.com $\endgroup$ – e-sushi Nov 4 '17 at 10:52

First, Crypto.SE is not a forum of attorneys, and is definitely not your attorney, and cannot provide legal advice. So don't make your business decisions on the basis of queer pseudonymous feathery strangers on the internet!

That said, the Bureau of Industry and Security's current web site (archived 2017-11-03 because it changes all the time) claims that ‘open source encryption source code available for free online’ is not subject to the Export Administration Regulations once you send email to crypt@bis.doc.gov and enc@nsa.gov notifying them that you have published it per 15 C.F.R. §742.15(b)(2).

You should always publish your source code, and provide ways for users to verify that it is being used (e.g., let users build it from source, and if you provide a binary distribution, also provide the tools for reproducible builds), because sensible users will reject secret proprietary crypto algorithms and implementations that they cannot study and audit or ask their friends to study and audit.

(Say what you will about the insanity of US crypto export controls, the BIS rules provide additional incentive to do the right thing about publishing crypto source code by giving you mountains of bureaucratic paperwork if you don't.)


Not the answer you're looking for? Browse other questions tagged or ask your own question.