5 January 2000
Source: http://www.steptoe.com/webdoc.nsf/Files/regs/$file/regs.pdf "Revised Draft of the BXA's Proposed Encryption Regulations," 17 pages. Stewart Baker, with Steptoe and Johnson (document source), is a member of the President's Export Council Subcommittee on Encryption (PECSENC). This is a note on the document from a newletter by Steptoe dated January 5, 2000:

The Bureau of Export Administration (BXA) has released a revised draft of its proposed new encryption regulations to selected industry groups for comment.  The new draft incorporates several significant further liberalizations, including changes to the definitions of the terms "retail," "government," and "open cryptographic application programming interfaces (CAPIs)," a relaxation of restrictions on the export of source code, and other revisions to the export reporting requirements and review process. BXA has said that its goal is to release new regulations by January 14, 2000, after incorporating public comments on the attached draft.

[Note: the first page is headed "DRAFT - 12/10/99;" all other pages are headed "DISCUSSION DRAFT II - 12/17/99." No other identification on the document. Type style as in the original.]

This is the revised version of the November 19 discussion draft. The November 19 draft laid out elements of the encryption export regulation which will implement the new policy announced on September 16, 1999. This draft reflects the various comments received on the first draft. There are substantial changes in the sections dealing with source code, retail products, reporting requirements, and the definition of governments and open cryptographic interfaces. There is a new section clarifying the requirements for exports to telecommunications and internet service providers and on screening internet ales to government end-users. Our new goal is publication of the actual regulation by January 14, 2000. Comments are welcome and, as before, should be sent to jlewis@bxa.doc.gov.

§734.2 IMPORTANT EAR TERMS AND PRINCIPLES

(b) Export and Reexport

(9) Export of encryption source code and object code software.

(ii) The export of encryption source code and object code software controlled for EI reasons under ECCN 5D002 on the Commerce Control List (see Supplement No. 1 to part 774 of the EAR), except for source code eligible for export under Sections 740.13(e) and 740.17(a)(5)(i), or retail encryption software eligible for export under Section 740.17(a)(3), includes downloading, or causing the downloading of, such software to locations (including electronic bulletin boards, Internet file transfer protocol, and World Wide Web sites) outside the U.S., or making such software available for transfer outside the United States, over wire, cable, radio, electromagnetic, photo optical, photoelectric or other comparable communications facilities accessible to persons outside the United States, including transfers from electronic bulletin boards, Internet file transfer protocol and World Wide Web sites, unless the person making the software available takes precautions adequate to prevent unauthorized transfer of such code. Such precautions shall include such measures as:

(A) The access control system, either through automated means or human intervention, checks the address of every system outside of the U.S. or Canada requesting or receiving a transfer and verifies that such systems do not have a government domain name or Internet address (e.g. “.gov,” “.gouv,” “.mil” or similar addresses).

(B) The access control system provides every requesting or receiving party with notice that the transfer includes or would include cryptographic software subject to export controls under the Export Administration Regulations, and that anyone receiving such a transfer cannot export the software without a license or other authorization; and

(C) Every party requesting or receiving a transfer of such software must acknowledge affirmatively that the software is not intended for use by a government end user, as defined in Part 772 and that he or she understands that the cryptographic software is subject to export controls under the Export Administration Regulations and that anyone receiving the transfer cannot export the software without a license or other authorization. BXA will consider acknowledgments in electronic form provided that they are adequate to assure legal undertakings similar to written acknowledgments.

§734.7 PUBLISHED INFORMATION AND SOFTWARE

(c) Notwithstanding paragraphs (a) and (b) of this section, note that encryption software controlled under ECCN 5D002 for “EI” reasons on the Commerce Control List (refer to Supplement No. 1 to part 774 of the EAR) remains subject to the EAR (refer to §740.13 (e) and 740.17(a)(5)(i) of the EAR for release under license exception).

§740.13 TECHNOLOGY AND SOFTWARE — UNRESTRICTED (TSU)

This License Exception authorizes exports and re-exports of operation technology and software; sales technology and software; software updates (bug fixes); “mass market” software subject to the General Software Note; and encryption source code eligible for export under License Exception TSU. Note that encryption software is no longer subject to the General Software Note (see paragraph (d)(2) of this section).

(d) General Software Note: "mass market" software

(2) Software not eligible for this License Exception. This License Exception is not available for certain encryption software controlled under ECCN 5D002. (Refer to the Cryptography Note in Category 5 - part 2 of the Commerce Control List (CCL) for information on Mass Market Encryption commodities and software. Also refer to §742.15(b)(1) and 748.3(b) of the EAR for information on item classifications for release from EI controls and NS controls).

(e) Unrestricted Encryption Source Code

(1) Encryption source code controlled under 5D002 which would be considered publicly available under Section 734.3(b)(3) and which is not subject to an express agreement for the payment of a licensing fee or royalty for further commercial production or sale of any product developed with the source code is released from EI controls and may be exported or re-exported without review under License Exception TSU, provided you have submitted written notification to BXA of the Internet address (e.g. URL) or a copy of the source code by the time of export. Submit the notification to BXA and send a copy to ENC Encryption Request Coordinator (see Section 740.17(g)(5) for mailing addresses).

(2) You may not knowingly export or re-export source code or products developed with this source code to Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria.

(3) Posting of the source code on the Internet (e.g., FTP or World Wide Web site) where the source code may be downloaded by anyone would not establish "knowledge" as described in subparagraph (2) of this section. In addition, such posting would not trigger "red flags" necessitating the affirmative duty to inquire under the "Know Your Customer" guidance provided in Supplement No. 3 to Part 732.

740.17 ENCRYPTION COMMODITIES AND SOFTWARE (ENC).

(a) Exports and re-exports of certain encryption commodities and software. As enumerated below, you may export and re-export encryption commodities and software including components (as defined in part 772) under License Exception ENC. License Exception ENC cannot be used if the encryption commodity or software provides an open cryptographic interface (as defined in part 772), unless the export is to a subsidiary of a U.S. firm, as described in paragraph (1) below.

(1) Encryption commodities, software and technology for U.S. subsidiaries. You may export and re-export any encryption item of any key length under ECCNs 5A002, 5D002 and 5E002 to foreign subsidiaries of U.S. firms (as defined in part 772) without review and classification. This includes source code and technology for internal company use, such as the development of new products. U.S. firms may also transfer under license exception encryption technology (5E002) to their foreign national employees in the U.S., (except foreign nationals from Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria) for internal company use, including the development of new products. All items produced or developed by U.S. subsidiaries with encryption commodities, software and technology exported under this paragraph are subject to the EAR and require review and classification before any sale or retransfer outside of the U.S. company.

(2) Encryption commodities and software. You may export and re-export under license exception ENC any encryption commodity, software and component after review and classification by BXA under ECCNs 5A002 and 5D002 to any individual, commercial firm or other non-government end user. Encryption products classified under this paragraph require a license for export and re-export to government end-users (see definition in Part 772).The former restriction limiting exports or re-exports to internal company proprietary use is now removed.

(3) Retail encryption commodities and software products. You may export and re-export to any end-user encryption commodities, software and components which have been reviewed and classified as retail under ECCNs 5A002 and 5D002. Retail encryption commodities, software and components are products which are:

(i) sold in tangible form through retail outlets which are independent of the manufacturer, or specifically designed for individual consumer use and sold or transferred through tangible or intangible means, or sold in large volume and available to the public by being sold, without restriction, through mail order transactions, electronic transactions, or telephone call transactions; and,

(ii) are those do not require substantial support for installation and use, where the cryptographic functionality cannot be easily changed by the user, where the encryption has not been modified or customized to customer specification, and are not network infrastructure products such as high end routers or switches designed for large volume communications.

(iii) Encryption products which provide equivalent functionality to other encryption products classified as retail will be considered retail.

(iv) Subject to the criteria in paragraphs (i) and (ii) above, retail encryption products include (but are not limited to) general purpose operating systems and their associated user-interface client software or general purpose operating systems with embedded networking and server capabilities; non-programmable encryption chips and chips that are constrained by design for retail products; low end routers, firewalls, and networking or cable equipment designed for small office or home use; programmable database management systems and associated application servers; low end servers and application-specific servers (including client-server applications, e.g. Secure Socket Layer (SSL)-based applications) that interface directly with the user; and encryption products distributed without charge or through free or anonymous downloads.

(v) Encryption products exported or reexported under paragraph (a)(3) can be used to provide services to any entity. Network-based applications which are functionally equivalent to retail encryption products will also be classified as retail.

(vi) Finance-specific encryption commodities and software of any key length that are restricted by design (e.g., highly field-formatted with validation procedures and not easily diverted to other end-uses) used to secure financial communications such as electronic commerce will be considered retail encryption products.

(vii) 56 bit products with key exchange mechanisms greater than 512 bits and up to and including 1024 bits or equivalent products which are not classified as mass market will be considered retail.

(4) Telecommunications and Internet Service Providers. Certain restrictions apply to Internet and telecommunications service providers. Any internet or telecommunications service provider can obtain retail products under License Exception ENC and use them to provide any service to any entity. Internet and telecommunications service providers can obtain and use any encryption product for their internal use and to provide any service under license exception ENC, but the following uses of any product not classified as retail are subject to license:

(i) The provision of services specific to governments end users, e.g., WAN, LAN, VPN, voice and dedicated-link services; application specific and e-commerce services, and PKI encryption services specifically for government end users only;

(ii) non-subscriber based bulk encryption of the telecommunications backbone or the link layer (layer 2 of the Open Systems Interconnect (OSI) model). This does not include encryption when used by the internet or telecommunications service provider for internal use only, e.g., the protection of company proprietary and business account information, or encryption between a customer and the service provider.

(5) Commercial encryption source code and general purpose encryption toolkits. You may export and re-export encryption source code not released under Section 740.13(e) or general purpose toolkits (application specific toolkits are covered under components, see Section 772) to non-government end-users, subject to the following provisions:

(i) Encryption source code which would be considered publicly available under Section 734.3(b)(3) and which is subject to an express agreement for the payment of a licensing fee or royalty for further commercial production or sale of any product developed using the source code may be exported or re-exported using license exception ENC to any end user without review and classification, provided you have submitted to BXA by the time of export written notification of the Internet address (e.g. URL) or a copy of the source code.

(ii) Posting of the source code on the Internet (e.g., FTP or World Wide Web site) where the source code may be downloaded by anyone would not trigger "red flags" necessitating the affirmative duty to inquire under the "Know Your Customer" guidance provided in Supplement No. 3 to Part 732.

(iii) Encryption source code which would not be considered publicly available and which does not include source code that when compiled provides an open cryptographic interface (see Section 740.17 (f)), may be exported or re-exported using license exception ENC to any non-government end user after review and classification by BXA.

(iv) General purpose encryption toolkits may be exported or re-exported after review and classification by BXA under license exception ENC to any non-government end-user.

(v) Any foreign product developed for commercial sale using encryption source code or general purpose toolkits exported under this section is subject to reporting requirements under paragraph (g) (3) of this section. Foreign products developed by bundling or compiling of source code are not subject to this reporting requirement.

(b) Ineligible Destinations. No encryption item(s) may be exported or re-exported under this license exception to Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria.

(c) Retransfers. Retransfers of encryption items listed in paragraph (a) of this section to other end-users or end-uses within the same country are prohibited unless otherwise authorized by this regulation or by license.

(d) Exports and reexports of foreign products incorporating U.S. encryption source code, components or general purpose encryption toolkits. Foreign products developed with or incorporating U.S.-origin encryption source code, components or toolkits remain subject to the EAR but do not require review and classification by BXA and can be exported or reexported without further authorization by BXA.

(e) Eligibility for License Exception ENC.

(1) You may initiate review and classification of your encryption items as required by paragraph (a) of this section by submitting a classification request in accordance with the provisions of §748.3(b) and Supplement 6 to Part 742 of the EAR. Indicate “License Exception ENC” in Block 9: Special purpose, on form BXA-748P. Submit the original request to BXA in accordance with §748.3 of the EAR and send a copy of the request to ENC Encryption Request Coordinator (see paragraph (g)(5) of this Section for mailing addresses). Unless otherwise notified by BXA, exporters may after thirty days export to any non-government end user any encryption product eligible under Section 740.17 (a) (2), (4) or (5). No exports to government end-users are allowed under this provision, and BXA reserves the right to suspend eligibility to export while a classification is pending.

(2) Grandfathering. Encryption commodities, components and software previously approved for export are now eligible for export and re-export without additional review to any non-government end-user under the provisions of Section 740.17 (a). This includes products approved under a license, an Encryption Licensing Arrangement, or products previously classified as finance-specific or as eligible to use License Exception ENC. Another classification is necessary to determine eligibility as a “retail” product under paragraph (a)(3). Products previously approved only for export to U.S. subsidiaries are not eligible for grandfathering.

(3) Key Length Increases. Exporters can increase the key lengths of previously classified products and continue to export without another review. No other change in the cryptographic functionality is allowed.

(i) Mass market commodities and software (i.e. 40 and 56-bit DES or equivalent) previously eligible to use License Exception TSU (or for hardware, ENC) may increase key lengths for the confidentiality algorithm up to 64 bits and up to and including 1024 bits for asymmetric algorithms used for key exchange and still be exported as a mass market product without an additional review. Any other product previously classified as 5A002 or 5D002 can, with any upgrade to the key length used for confidentiality or key exchange algorithms, now be exported under provisions of License Exception ENC to any nongovernment end-user without an additional review. Another classification is necessary to determine eligibility as a “retail” product under paragraph (a)(3).

[(ii) not used.]

(iii) Exporters must certify to BXA in a letter from a senior corporate official that the only change to the encryption product is the key length for confidentiality or key exchange algorithms and that there is no other change in cryptographic functionality. Certifications must include the original authorization number issued by BXA and the date of issuance. BXA must receive this certification prior to any export of upgraded products. The certification should be sent to BXA, with a copy to ENC Encryption Request Coordinator (see paragraph (g)(5) of this section for mailing addresses).

(f) Open cryptographic interfaces. License Exception ENC shall not apply to exports or re-exports of encryption commodities, software and components (unless exported to a subsidiary of a U.S. company under paragraph (a)(i)), if the encryption product provides an open cryptographic interface (as defined in part 772). This does not apply to source code that would be considered publicly available under Section 734.3(b)(3).

(g) Reporting requirements.

(1) No reporting is required for exports of:

(i) any encryption to U.S. subsidiaries;

(ii) finance-specific products;

(iii) encryption commodities or software with a symmetric key length not exceeding 64 bits or otherwise qualifying for mass market treatment;

(iv) retail products exported to individual consumers;

(v) any export made via free or anonymous download;

(vi) any export made from or to a U.S. bank , financial institution or their subsidiaries, affiliates, customers or contractors for banking or financial operations.

(2) Exporters must provide all available information as follows:

(i) for items exported to a distributor or other reseller, the name and address of the distributor or reseller and the quantity exported and, if collected the end user name and address;

(ii) for items exported through direct sale, the name and address of the recipient and the quantity exported (except for retail products if the end user is an individual consumer).

(3) For direct sales or transfers of encryption components or source code described under Section 740.17 (5), or general purpose encryption toolkits, you must submit the names and addresses of the product manufacturers using these encryption components, commercial source code or general purpose encryption toolkits and a non-proprietary technical description of the products for which the component, source code or toolkit is being used (i.e. brochures, other documentation, descriptions or other identifiers of the final foreign product; the algorithm and key lengths used; general programming interfaces to the product, if known; any standards or protocols that the foreign product adheres to; and source code, if available).

(4) Exporters of encryption commodities, software and components which were previously classified under License Exception ENC, or which have been licensed for export under an Encryption Licensing Arrangement, must comply with the reporting requirements of this section.

(5) Beginning [Date of Publication], you must submit reports required under this section semi-annually to BXA. For exports occurring between January 1 and June 30, a report is due no later than August 1. For exports occurring between July 1 and December 31, a report is due no later than February 1. The report must include the classification or other authorization number.

These reports must be provided in electronic form to BXA; suggested file formats for electronic submission include spreadsheets, tabular text or structured text. Exporters may request other reporting arrangements with BXA to better reflect their business models. Reports should be sent electronically to crypt@bxa.doc.gov, or disks and CDs can be mailed to the following addresses:

(1) Department of Commerce
Bureau of Export Administration
Office of Strategic Trade and Foreign Policy Controls
14th Street and Pennsylvania Ave., N.W., Room 2705
Washington, D.C. 20230
Attn: Encryption Reports

(2) A copy of the report should be sent to:

Attn: ENC Encryption Request Coordinator
9800 Savage Road, Suite 6131
Ft. Meade, MD 20755-6000

(h) Distributors and Resellers. U.S. or foreign distributors, resellers or other entities who are not original manufacturers of encryption commodities and software are permitted to use License Exception ENC only in instances where the export or re-export meets the applicable terms and conditions of §740.17.

§742.15 ENCRYPTION ITEMS

Encryption items can be used to maintain the secrecy of information, and thereby may be used by persons abroad to harm national security, foreign policy and law enforcement interests. As the President indicated in E.O. 13026 and in his Memorandum of November 15, 1996, export of encryption software, like export of encryption hardware, is controlled because of this functional capacity to encrypt information on a computer system, and not because of any informational or theoretical value that such software may reflect, contain, or represent, or that its export may convey to others abroad. For this reason, export controls on encryption software are distinguished from controls on other software regulated under the EAR.

(a) License requirements

Licenses are required for exports and re-exports to all destinations, except Canada, for items controlled under ECCNs having an “EI” (for “encryption items”) under the “Control(s)” paragraph. Such items include: encryption commodities controlled under ECCN 5A002; encryption software controlled under ECCN 5D002; and encryption technology controlled under ECCN 5E002. Refer to part 772 of the EAR for the definition of “encryption items”.

(b) Licensing policy

The following licensing policies apply to items identified in paragraph (a) of this section. Except as otherwise noted, applications will be reviewed on a case-by-case basis by BXA, in conjunction with other agencies, to determine whether the export or re-export is consistent with U.S. national security and foreign policy interests. For subsequent bundling and updates of these items see paragraph (n) of §770.2 of the EAR.

(1) Encryption commodities, software and technology under ECCNs 5A992, 5D992 and 5E992. Certain encryption commodities, software and technology may be released from “EI” controls, after classification by BXA as ECCNs 5A992, 5D992 or 5E992. Items controlled under these ECCNs are not subject to either “EI” or “NS” controls and are eligible for export and re-export to all destinations except Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria. Refer to §748.3(b)(3) of the EAR for additional information regarding classification requests. The following encryption items may be eligible for such treatment:

(i) 56-bit encryption commodities, software and technology. Encryption commodities, software and technology up to and including 56-bits with an asymmetric key exchange algorithm not exceeding 512 bits may be classified under ECCNs 5A992, 5D992 or 5E992.

(ii) Key management products. Products which only provide key management with asymmetric key exchange algorithms not exceeding 512 bits may be eligible for classification under ECCNs 5A992 or 5D992.

(iii) 64-bit mass market encryption commodities and software. Mass market encryption commodities and software with key lengths not exceeding 64-bit for the symmetric algorithm may be eligible for classification by BXA under ECCNs 5A992 or 5D992. Refer to the Cryptography Note (Note 3) to Part 2 of Category 5 of the CCL for a definition of mass market commodities and software. Key exchange mechanisms, proprietary key exchange mechanisms, or company proprietary commodities and software implementations may also be eligible for this treatment. Refer to Supplement No. 6 to part 742 and §748.3(b)(3) of the EAR for additional information.

(iv) For classification of these encryption items under these ECCNs, mark “NLR” in Block 9: Special purpose, on form BXA-748P, of your classification request.

(2) Encryption commodities and software eligible for classification under ECCNs 5A002 and 5D002. Items classified by BXA as retail products under ECCNs 5A002 and 5D002 are permitted for export and re-export to any end-user. All other encryption commodities and software, including components, classified by BXA under ECCNs 5A002 and 5D002 may be exported to any individual, commercial firm or other non-government end-user. Any encryption item (including technology classified under 5E002) will be permitted for export or re-export to U.S. subsidiaries (as defined in part 772). Products developed using U.S. encryption items are subject to the EAR. No exports are authorized to Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria.

(3) Encryption Licensing. Applicants may submit license applications for exports and re-exports of encryption items not eligible for export under license exception in unlimited quantities for all destinations except Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria, including exports and re-exports of encryption technology to strategic partners of U.S. companies (as defined in part 772). For Encryption Licensing Arrangements, the applicant must specify the sales territory and class of end-user. Encryption Licensing Arrangements are valid for four years and may require reporting. Licenses required for exports of encryption items to governments, or internet and telecommunications service providers for the provision of specific services to governments may be favorably considered for civil uses, e.g. social or financial services to the public, civil justice, social insurance, pensions and retirement, taxes and communications between governments and their citizens. Applications for the export and re-export of all other encryption items will be reviewed on a case-by-case basis.

PART 770

§770.2 Commodity interpretations.

(n) Interpretation 14: Encryption commodity and software reviews. Classification of encryption commodities or software is required to determine eligibility for all licensing mechanisms except source code (see S.740.13(e) and (a)(5)(i)) or exports to subsidiaries of U.S. firms (see 740.17(a)(1)). Note that subsequent bundling, patches, upgrades or releases, including name changes, may be exported or re-exported under the applicable provisions of the EAR without further technical review as long as the functional encryption capacity of the originally reviewed encryption product has not been modified or enhanced. This does not extend to products controlled under a different category on the CCL.

PART 772 - DEFINITIONS OF TERMS

Asymmetric algorithm. (Cat 5, part II) A cryptographic algorithm using different, mathematically-related keys for encryption and decryption. A common use of asymmetric algorithms" is key management.

Encryption Component. Any encryption commodity or software (except source code), including encryption chips, integrated circuits, application specific encryption toolkits, or executable or linkable modules which alone are incapable of performing complete cryptographic functions, and is designed or intended for use in or the production of another encryption item.

Government End-user (as applied to encryption items). A government end-user is (a) any foreign central, regional or local government department, agency, or other entity performing governmental functions; including governmental research institutions, governmental corporations or their separate business units (as defined in part 772 of the EAR) which are engaged in the manufacture or distribution of items or services controlled on the Wassenaar Munitions List, and international governmental organizations;

(b) this term does not include the following public entities: utilities (including telecommunications companies and Internet service providers); banks and financial institutions; transportation; broadcast or entertainment; educational organizations; civil health and medical organizations; retail or wholesale firms; and manufacturing or industrial entities not engaged in the manufacture or distribution of items or services controlled on the Wassenaar Munitions List.

Open Cryptographic Interface. A mechanism which is designed to allow a customer or other party to insert cryptographic functionality without the intervention, help or assistance of the manufacturer or its agents, e.g., manufacturer’s signing of cryptographic code or proprietary interfaces. If the programmatic interface to the cryptographic hardware or object code software has a fixed set of cryptographic algorithms, key lengths or key exchange management systems that cannot be changed, it will not be considered an “open” cryptographic interface. All general application programming interface (i.e. those that accept either a cryptographic or non-cryptographic interface but do not themselves maintain any cryptographic functionality) will not be considered “open” cryptographic interfaces.

"Symmetric algorithm". (Cat 5, part II) A cryptographic algorithm using an identical key for both encryption and decryption. A common use of "symmetric algorithms" is confidentiality of data.

PART 774

Part II - "Information Security"

Note 1: The control status of "information security" equipment, "software", systems, application specific "electronic assemblies", modules, integrated circuits, components, or functions is determined in Category 5, part 2 even if they are components or "electronic assemblies" of other equipment.

Note 2: Category 5 - part 2 encryption products, when accompanying their user for the user's personal use, are eligible for license exceptions TMP or BAG.

Note 3: Cryptography Note: ECCNs 5A002 and 5D002 do not control items that meet all of the following:

a. Generally available to the public by being sold, without restriction, from stock at retail selling points by means of any of the following:

1. Over-the-counter transactions;

2. Mail order transactions;

3. Electronic transactions; or

4. Telephone call transactions;

b. The cryptographic functionality cannot be easily changed by the user;

c. Designed for installation by the user without further substantial support by the supplier;

d. Does not contain a "symmetric algorithm" employing a key length exceeding 64-bits; and

e. When necessary, details of the items are accessible and will be provided, upon request, to the appropriate authority in the exporter's country in order to ascertain compliance with conditions described in paragraphs (a) through (d) of this note. See §742.15(b)(1) of the EAR.

A. Systems, Equipment and Components

5A002 Systems, equipment, application specific "electronic assemblies", modules and integrated circuits for "information security", and other specially designed components therefor.

* * * * *

List of Items Controlled

Unit: $ value

Related Controls: See also 5A992. This entry does not control: a.) "Personalized smart cards "where the cryptographic capability is restricted for use in equipment or systems excluded from control paragraphs b through f of this note. Note that if a "personalized smart card" has multiple functions, the control status of each function is assessed individually; b.) Receiving equipment for radio broadcast, pay television or similar restricted audience television of the consumer type, without digital encryption except that exclusively used for sending the billing or program-related information back to the broadcast providers c.) Portable or mobile radiotelephones for civil use (e.g., for use with commercial civil cellular radio communications systems) that are not capable of end-to-end encryption; d.) Equipment where the cryptographic capability is not user-accessible and which is specially designed and limited to allow any of the following: 1.) Execution of copy-protected "software"; 2.) Access to any of the following: a.) Copy-protected read-only media; or b.) Information stored in encrypted form on media (e.g., in connection with the protection of intellectual property rights) where the media is offered for sale in identical sets to the public; or 3.) One-time encryption of copyright protected audio/video data; e.) Cryptographic equipment specially designed and limited for banking use or money transactions; f.) Cordless telephone equipment not capable of end-to-end encryption where the maximum effective range of unboosted cordless operation (i.e., a single, unrelayed hop between terminal and home base station) is less than 400 meters according to the manufacturer's specifications.

Related Definitions: 1.) The term "money transactions" in paragraph e.) of Related Controls includes the collection and settlement of fares or credit functions. 2.) For the control of global navigation satellite systems receiving equipment containing or employing decryption (i.e., GPS or GLONASS) see 7A005.

Items:

Technical Note: Parity bits are not included in the key length.

a. Systems, equipment, application specific "electronic assemblies", modules and integrated circuits for "information security", and other specially designed components therefor:

a.1. Designed or modified to use "cryptography" employing digital techniques performing any cryptographic function other than authentication or digital signature having any of the following:

Technical Notes:

1. Authentication and digital signature functions include their associated key management function.

2. Authentication includes all aspects of access control where there is no encryption of files or text except as directly related to the protection of passwords, Personal Identification Numbers (PINs) or similar data to prevent unauthorized access.

3. "Cryptography" does not include "fixed” data compression or coding techniques.

Note: 5A002.a.1 includes equipment designed or modified to use "cryptography" employing analogue principles when implemented with digital techniques.

a.1.a. A "symmetric algorithm" employing a key length in excess of 56-bits; or

a.1.b. An "asymmetric algorithm" where the security of the algorithm is based on any of the following:

a.1.b.1. Factorization of integers in excess of 512 bits (e.g., RSA);

a.1.b.2. Computation of discrete logarithms in a multiplicative group of a finite field of size greater than 512 bits (e.g., Diffie-Hellman over Z/pZ); or

a.1.b.3. Discrete logarithms in a group other than mentioned in 5A002.a.1.b.2 in excess of 112 bits (e.g., Diffie-Hellman over an elliptic curve);

a.2. Designed or modified to perform cryptoanalytic functions;

a.3. [Reserved]

a.4. Specially designed or modified to reduce the compromising emanations of information-bearing signals beyond what is necessary for the health, safety or electromagnetic interference standards;

a.5. Designed or modified to use cryptographic techniques to generate the spreading code for "spread spectrum" or the hopping code for "frequency agility" systems;

a.6. Designed or modified to provide certified or certifiable "multilevel security" or user isolation at a level exceeding Class B2 of the Trusted Computer System Evaluation Criteria (TCSEC) or equivalent;

a.7. Communications cable systems designed or modified using mechanical, electrical or electronic means to detect surreptitious intrusion.

5B002 Information Security - test, inspection and "production" equipment.

License Requirements

5E002 "Technology" according to the General Technology Note" for the "development", "production" or "use" of equipment controlled by 5A002 or 5B002 or "software" controlled by 5D002.

License Requirements

Supplement No. 2 to Part 774

GENERAL TECHNOLOGY AND SOFTWARE NOTES

2. Note: The General Software Note does not apply to "software" controlled by Category 5 -part 2 ("Information Security"). For "software" controlled by Category 5, part 2, see Supplement No. 1 to part 774, Category 5, part 2, Note 3 - Cryptography Note.

SUPPLEMENT NO. 6 TO PART 742

Guidelines for Submitting a Classification Request for Encryption Items

Classification requests for encryption items must be submitted on Form BXA-748P, in accordance with Section 748.3 of the EAR. Insert in Block 9: Special Purpose of the Form BXA-748P, the phrase “License Exception ENC” or “NLR”, based on your classification request. Failure to insert this phrase will delay processing. In addition, the Bureau of Export Administration recommends that such requests be delivered via courier service to: Bureau of Export Administration, Office of Exporter Services, Room 2705, 14th Street and Pennsylvania Ave., N.W. Washington, D.C. 20230. In addition, you must send a copy of the request and all supporting documents to: Attn: ENC Encryption Request Coordinator, 9800 Savage Road, Suite 6131, Fort Meade, MD 20755-6000.

(a) Requests for encryption items will be processed in thirty (30) working days from receipt of a properly completed request.

(b)(1) To submit a classification request for a technical review of commodities and software, ensure that the information provided includes brochures or other documentation or specifications (to include applicable cryptographic source code) related to the technology, commodity or software, as well as any additional information which you believe would assist the review process. You must provide the following information in a cover letter to the classification request:

(i) Clearly state at the top of the page either “ENC” or “NLR” - 30 Day Technical Review Requested;”

(ii) State that you have reviewed and determined that the commodity or software subject to the classification request meets the criteria of this Supplement;

(iii) State the name of the commodity or software product being submitted for review;

(iv) State how the commodity or software has been written to preclude user modification of the encryption algorithm, key management mechanism, and key space;

(v) State that a duplicate copy has been sent to the ENC Encryption Request Coordinator;

(vi) Provide the following information for the commodity or software product:

(A) Description of all encryption algorithms and key lengths, e.g. source code, and how the algorithms are used. If any combination of different algorithms are used in the same product, also state how each is applied to the data.

(B) Pre-processing information of plaintext data before encryption (e.g. compression of the data).

(C) Post-processing information of cipher text data after encryption (e.g. packetization of the encrypted data).

(D) For classification requests regarding components:

(1) Reference the application for the components if known;

(2) State if there is a general programming interface to the component;

(3) State whether the component is constrained by function;

(4) List any standards and protocols that the component adheres to;

(5) Include a complete description of all functionalities and their accessibility.

(6) Encryption components need to be clearly identified to include the name of the manufacturer, component model number, or other identifier.

(E) For classification requests regarding source code:

(1) If applicable, reference the executable product that has already received a technical review.

(2) Include whether the source code has been modified by deleting the encryption algorithm, its associated key management routine(s) and all calls to the algorithm from the source code, or by providing the encryption algorithm and associated key management routine(s) in object code with all calls to the algorithm hidden. You must provide the technical details on how you have modified the source code.

(3) Include a copy of the sections of the source code that contain the encryption algorithm, key management routines, and their related calls.

(c)(1) To submit a classification request for a review of technology, you must provide the following information in a cover letter to the classification request:

(i) Clearly state at the top of the page either “ENC” or “NLR” - 30 Day Technical Review Requested”;

(ii) State that you have reviewed and determined that the technology subject to the classification request meets the criteria of this Supplement;

(iii) State the name of the technology being submitted for review;

(iv) State that a duplicate copy has been sent to the ENC Encryption Request Coordinator;

(v) Provide the following information for the technology product:

(A) Description of encryption algorithm, if any combination of different algorithms are used in the same product, also state how each is applied to the data.

(B) Description of public key algorithm or symmetric key algorithm, (e.g. source code, is used to encrypt keys and the applicable key space).

HTML by Cryptome.