Good reminder that France is one of the rare countries in the world to have a declaration obligation when **importing** cryptography.
-
Good reminder that France is one of the rare countries in the world to have a declaration obligation when **importing** cryptography.
While one doesn’t need approval, it is critical to file an accurate declaration of the encryption system to the Cybersecurity agency ANSSI.
According to prosecutors, Telegram failed to accurately complete its declaration.
https://cyber.gouv.fr/faq-demande-dautorisation
https://hachyderm.io/@evacide/113029696954871293 -
Frederic Jacobsreplied to Frederic Jacobs last edited by
Fondly remembering trying to figure out the ANSSI declaration requirements for Signal in 2014 for publication on the App Store
-
Nils Adermannreplied to Frederic Jacobs last edited by
@fj I just struggle to understand what "import" means in this context? Making an app available on the French app store? Is it fine if jt's just on the web used by people in France?
-
@fj But you did comply? I'm trying to understand whether this is just a law to use when someone's encryption causes a real problem.
-
@emptywheel When you add France to the list of countries to distribute an app to in app stores, you are asked if you are importing cryptography into France, and you need to upload your declaration.
So yes, for Signal, we did add the list of algorithms that we used (the app is open-source) and answered the questions on key storage and other topics that are in the declaration form.
-