Thanks for the PM & answer
v4, me likey !
I would not ship an encryption product internationally without verifying for myself that it is legal to do so, by referring to written permission to do so given by the United State Department of State. If DES is no longer export controlled, I have to see it in writing.
That's the right attitude to have & I agree with that.
IIRC the researches I have done when successfully exporting my T3011DX last year, it all revolve about EAR (Export Administration Regulations).
As it is a quick reply, I don't currently have handy the big pdf file I had done about all the subtilities, but I can summarise with that :
that Gov link is telling us that for symetrical algo : "
items with a key length of 56 bits or less are not in 5A002.a. Note that parity bits do not count towards the key length". DES complies with that definition as it is using a keylength equal to 56 bit, not counting parity.
Next is : "
In that case, you should review other entries in Category 5 Part 2 and other Categories on the CCL (e.g., Cat. 4 or Cat. 5, Part 1). If it is not described in any other Category then it can be classified as EAR99."
I will not bore you with Cat5Part2 & CCL as I will surely exceed the number of characters allowed to type a message here by doing so, but I did not find specific entries barring DES for export, and you can verify that for yourself by reading these docs online.
(BTW, here is two handy short guides :
https://www.bis.doc.gov/index.php/d.../1652-cat-5-part-2-quick-reference-guide/file &
https://www.bis.doc.gov/index.php/documents/new-encryption/1654-flowchart1/file)
See here for official guidance :
Encryption and Export Administration Regulations (EAR)
It results that DES can be classified as EAR99 in todays world (it's no longer the 80's) meaning that : "
EAR99. The majority of commercial products are designated EAR99 and generally will not require a license to be exported or reexported " ("generally", because there's still restrictions with embargoed or sanctioned countries, etc... see here :
Sanctioned Destinations)
To the best of my knowledge, France is not currently embargoed or sanctioned by the US of A... Feel free to correct me otherwise
...
By the way, Fed-std 1027 & FIPS 46-2 are both depreciated...
Hell, you could probably even argue that nowadays Rijndael is not subject to a special licence because : " Encryption items that are publicly available as further described below are not subject to the Export Administration Regulation. Sections 734.3(b)(3) and 734.7 define what is publicly available and published.
Common examples are free apps posted online or mass market software available as a free download. "
(
1. Encryption items NOT Subject to the EAR)
DES has been cracked since 1997 (DES was developped in 1975-77 !), nowadays only collectors and tinkerers are seriously interested in toying with DES...
Else you have a serious security problem !
As I like to be punctillious, we just (very briefly) saw the EXPORT control side, now let's see the import control (after all, France has its own laws too...)
Well , DES is no longer IMPORT controlled here, since the 2004 LCEN law, modified by several (2007 & 2015) decrees...
(sorry, I will not translate that as translation is said to distort the law and so only the French version is allowed to legally prevail when talking about French laws, I guess it surely the same for US laws ? You can still try Google Translate but good luck with that...)
So, as you can see, it's ok to export DES from the USA and import it to France ;-)
We are no longer in the 80's, and we are not talking about TEA2, SAVILLE or EINRIDE here =P
Nevertheless, although my answer can sounds a bit "smirky", you did the right thing by asking to see this in writing and I commend you for that.
Sorry if that answer isn't "formatted" like a real law text would be, but it would have been MUCH longer ^^ (hence why I made a pdf for exactly this purpose, but I don't have it here -_-)
I think the main thing is there, but don't hesitate to ask if you want more...
