Source: http://cryptome.org/bxa121799.htm
Timestamp: 2019-04-25 02:43:59+00:00

Document:
The Bureau of Export Administration (BXA) has released a revised draft of its proposed new encryption regulations to selected industry groups for comment. The new draft incorporates several significant further liberalizations, including changes to the definitions of the terms "retail," "government," and "open cryptographic application programming interfaces (CAPIs)," a relaxation of restrictions on the export of source code, and other revisions to the export reporting requirements and review process. BXA has said that its goal is to release new regulations by January 14, 2000, after incorporating public comments on the attached draft.
This is the revised version of the November 19 discussion draft. The November 19 draft laid out elements of the encryption export regulation which will implement the new policy announced on September 16, 1999. This draft reflects the various comments received on the first draft. There are substantial changes in the sections dealing with source code, retail products, reporting requirements, and the definition of governments and open cryptographic interfaces. There is a new section clarifying the requirements for exports to telecommunications and internet service providers and on screening internet ales to government end-users. Our new goal is publication of the actual regulation by January 14, 2000. Comments are welcome and, as before, should be sent to jlewis@bxa.doc.gov.
(9) Export of encryption source code and object code software.
(A) The access control system, either through automated means or human intervention, checks the address of every system outside of the U.S. or Canada requesting or receiving a transfer and verifies that such systems do not have a government domain name or Internet address (e.g. .gov, .gouv, .mil or similar addresses).
(C) Every party requesting or receiving a transfer of such software must acknowledge affirmatively that the software is not intended for use by a government end user, as defined in Part 772 and that he or she understands that the cryptographic software is subject to export controls under the Export Administration Regulations and that anyone receiving the transfer cannot export the software without a license or other authorization. BXA will consider acknowledgments in electronic form provided that they are adequate to assure legal undertakings similar to written acknowledgments.
(c) Notwithstanding paragraphs (a) and (b) of this section, note that encryption software controlled under ECCN 5D002 for EI reasons on the Commerce Control List (refer to Supplement No. 1 to part 774 of the EAR) remains subject to the EAR (refer to §740.13 (e) and 740.17(a)(5)(i) of the EAR for release under license exception).
This License Exception authorizes exports and re-exports of operation technology and software; sales technology and software; software updates (bug fixes); mass market software subject to the General Software Note; and encryption source code eligible for export under License Exception TSU. Note that encryption software is no longer subject to the General Software Note (see paragraph (d)(2) of this section).
(2) Software not eligible for this License Exception. This License Exception is not available for certain encryption software controlled under ECCN 5D002. (Refer to the Cryptography Note in Category 5 - part 2 of the Commerce Control List (CCL) for information on Mass Market Encryption commodities and software. Also refer to §742.15(b)(1) and 748.3(b) of the EAR for information on item classifications for release from EI controls and NS controls).
(1) Encryption source code controlled under 5D002 which would be considered publicly available under Section 734.3(b)(3) and which is not subject to an express agreement for the payment of a licensing fee or royalty for further commercial production or sale of any product developed with the source code is released from EI controls and may be exported or re-exported without review under License Exception TSU, provided you have submitted written notification to BXA of the Internet address (e.g. URL) or a copy of the source code by the time of export. Submit the notification to BXA and send a copy to ENC Encryption Request Coordinator (see Section 740.17(g)(5) for mailing addresses).
(2) You may not knowingly export or re-export source code or products developed with this source code to Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria.
(3) Posting of the source code on the Internet (e.g., FTP or World Wide Web site) where the source code may be downloaded by anyone would not establish "knowledge" as described in subparagraph (2) of this section. In addition, such posting would not trigger "red flags" necessitating the affirmative duty to inquire under the "Know Your Customer" guidance provided in Supplement No. 3 to Part 732.
740.17 ENCRYPTION COMMODITIES AND SOFTWARE (ENC).
(a) Exports and re-exports of certain encryption commodities and software. As enumerated below, you may export and re-export encryption commodities and software including components (as defined in part 772) under License Exception ENC. License Exception ENC cannot be used if the encryption commodity or software provides an open cryptographic interface (as defined in part 772), unless the export is to a subsidiary of a U.S. firm, as described in paragraph (1) below.
(1) Encryption commodities, software and technology for U.S. subsidiaries. You may export and re-export any encryption item of any key length under ECCNs 5A002, 5D002 and 5E002 to foreign subsidiaries of U.S. firms (as defined in part 772) without review and classification. This includes source code and technology for internal company use, such as the development of new products. U.S. firms may also transfer under license exception encryption technology (5E002) to their foreign national employees in the U.S., (except foreign nationals from Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria) for internal company use, including the development of new products. All items produced or developed by U.S. subsidiaries with encryption commodities, software and technology exported under this paragraph are subject to the EAR and require review and classification before any sale or retransfer outside of the U.S. company.
(2) Encryption commodities and software. You may export and re-export under license exception ENC any encryption commodity, software and component after review and classification by BXA under ECCNs 5A002 and 5D002 to any individual, commercial firm or other non-government end user. Encryption products classified under this paragraph require a license for export and re-export to government end-users (see definition in Part 772).The former restriction limiting exports or re-exports to internal company proprietary use is now removed.
(ii) are those do not require substantial support for installation and use, where the cryptographic functionality cannot be easily changed by the user, where the encryption has not been modified or customized to customer specification, and are not network infrastructure products such as high end routers or switches designed for large volume communications.
(iii) Encryption products which provide equivalent functionality to other encryption products classified as retail will be considered retail.
(iv) Subject to the criteria in paragraphs (i) and (ii) above, retail encryption products include (but are not limited to) general purpose operating systems and their associated user-interface client software or general purpose operating systems with embedded networking and server capabilities; non-programmable encryption chips and chips that are constrained by design for retail products; low end routers, firewalls, and networking or cable equipment designed for small office or home use; programmable database management systems and associated application servers; low end servers and application-specific servers (including client-server applications, e.g. Secure Socket Layer (SSL)-based applications) that interface directly with the user; and encryption products distributed without charge or through free or anonymous downloads.
(v) Encryption products exported or reexported under paragraph (a)(3) can be used to provide services to any entity. Network-based applications which are functionally equivalent to retail encryption products will also be classified as retail.
(vi) Finance-specific encryption commodities and software of any key length that are restricted by design (e.g., highly field-formatted with validation procedures and not easily diverted to other end-uses) used to secure financial communications such as electronic commerce will be considered retail encryption products.
(vii) 56 bit products with key exchange mechanisms greater than 512 bits and up to and including 1024 bits or equivalent products which are not classified as mass market will be considered retail.
(ii) non-subscriber based bulk encryption of the telecommunications backbone or the link layer (layer 2 of the Open Systems Interconnect (OSI) model). This does not include encryption when used by the internet or telecommunications service provider for internal use only, e.g., the protection of company proprietary and business account information, or encryption between a customer and the service provider.
(i) Encryption source code which would be considered publicly available under Section 734.3(b)(3) and which is subject to an express agreement for the payment of a licensing fee or royalty for further commercial production or sale of any product developed using the source code may be exported or re-exported using license exception ENC to any end user without review and classification, provided you have submitted to BXA by the time of export written notification of the Internet address (e.g. URL) or a copy of the source code.
(ii) Posting of the source code on the Internet (e.g., FTP or World Wide Web site) where the source code may be downloaded by anyone would not trigger "red flags" necessitating the affirmative duty to inquire under the "Know Your Customer" guidance provided in Supplement No. 3 to Part 732.
(iii) Encryption source code which would not be considered publicly available and which does not include source code that when compiled provides an open cryptographic interface (see Section 740.17 (f)), may be exported or re-exported using license exception ENC to any non-government end user after review and classification by BXA.
(iv) General purpose encryption toolkits may be exported or re-exported after review and classification by BXA under license exception ENC to any non-government end-user.
(v) Any foreign product developed for commercial sale using encryption source code or general purpose toolkits exported under this section is subject to reporting requirements under paragraph (g) (3) of this section. Foreign products developed by bundling or compiling of source code are not subject to this reporting requirement.
(b) Ineligible Destinations. No encryption item(s) may be exported or re-exported under this license exception to Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria.
(c) Retransfers. Retransfers of encryption items listed in paragraph (a) of this section to other end-users or end-uses within the same country are prohibited unless otherwise authorized by this regulation or by license.
(d) Exports and reexports of foreign products incorporating U.S. encryption source code, components or general purpose encryption toolkits. Foreign products developed with or incorporating U.S.-origin encryption source code, components or toolkits remain subject to the EAR but do not require review and classification by BXA and can be exported or reexported without further authorization by BXA.
(1) You may initiate review and classification of your encryption items as required by paragraph (a) of this section by submitting a classification request in accordance with the provisions of §748.3(b) and Supplement 6 to Part 742 of the EAR. Indicate License Exception ENC in Block 9: Special purpose, on form BXA-748P. Submit the original request to BXA in accordance with §748.3 of the EAR and send a copy of the request to ENC Encryption Request Coordinator (see paragraph (g)(5) of this Section for mailing addresses). Unless otherwise notified by BXA, exporters may after thirty days export to any non-government end user any encryption product eligible under Section 740.17 (a) (2), (4) or (5). No exports to government end-users are allowed under this provision, and BXA reserves the right to suspend eligibility to export while a classification is pending.
(2) Grandfathering. Encryption commodities, components and software previously approved for export are now eligible for export and re-export without additional review to any non-government end-user under the provisions of Section 740.17 (a). This includes products approved under a license, an Encryption Licensing Arrangement, or products previously classified as finance-specific or as eligible to use License Exception ENC. Another classification is necessary to determine eligibility as a retail product under paragraph (a)(3). Products previously approved only for export to U.S. subsidiaries are not eligible for grandfathering.
(i) Mass market commodities and software (i.e. 40 and 56-bit DES or equivalent) previously eligible to use License Exception TSU (or for hardware, ENC) may increase key lengths for the confidentiality algorithm up to 64 bits and up to and including 1024 bits for asymmetric algorithms used for key exchange and still be exported as a mass market product without an additional review. Any other product previously classified as 5A002 or 5D002 can, with any upgrade to the key length used for confidentiality or key exchange algorithms, now be exported under provisions of License Exception ENC to any nongovernment end-user without an additional review. Another classification is necessary to determine eligibility as a retail product under paragraph (a)(3).
(iii) Exporters must certify to BXA in a letter from a senior corporate official that the only change to the encryption product is the key length for confidentiality or key exchange algorithms and that there is no other change in cryptographic functionality. Certifications must include the original authorization number issued by BXA and the date of issuance. BXA must receive this certification prior to any export of upgraded products. The certification should be sent to BXA, with a copy to ENC Encryption Request Coordinator (see paragraph (g)(5) of this section for mailing addresses).
(f) Open cryptographic interfaces. License Exception ENC shall not apply to exports or re-exports of encryption commodities, software and components (unless exported to a subsidiary of a U.S. company under paragraph (a)(i)), if the encryption product provides an open cryptographic interface (as defined in part 772). This does not apply to source code that would be considered publicly available under Section 734.3(b)(3).
(vi) any export made from or to a U.S. bank , financial institution or their subsidiaries, affiliates, customers or contractors for banking or financial operations.
(ii) for items exported through direct sale, the name and address of the recipient and the quantity exported (except for retail products if the end user is an individual consumer).
(3) For direct sales or transfers of encryption components or source code described under Section 740.17 (5), or general purpose encryption toolkits, you must submit the names and addresses of the product manufacturers using these encryption components, commercial source code or general purpose encryption toolkits and a non-proprietary technical description of the products for which the component, source code or toolkit is being used (i.e. brochures, other documentation, descriptions or other identifiers of the final foreign product; the algorithm and key lengths used; general programming interfaces to the product, if known; any standards or protocols that the foreign product adheres to; and source code, if available).
(5) Beginning [Date of Publication], you must submit reports required under this section semi-annually to BXA. For exports occurring between January 1 and June 30, a report is due no later than August 1. For exports occurring between July 1 and December 31, a report is due no later than February 1. The report must include the classification or other authorization number.
(h) Distributors and Resellers. U.S. or foreign distributors, resellers or other entities who are not original manufacturers of encryption commodities and software are permitted to use License Exception ENC only in instances where the export or re-export meets the applicable terms and conditions of §740.17.
Encryption items can be used to maintain the secrecy of information, and thereby may be used by persons abroad to harm national security, foreign policy and law enforcement interests. As the President indicated in E.O. 13026 and in his Memorandum of November 15, 1996, export of encryption software, like export of encryption hardware, is controlled because of this functional capacity to encrypt information on a computer system, and not because of any informational or theoretical value that such software may reflect, contain, or represent, or that its export may convey to others abroad. For this reason, export controls on encryption software are distinguished from controls on other software regulated under the EAR.
Licenses are required for exports and re-exports to all destinations, except Canada, for items controlled under ECCNs having an EI (for encryption items) under the Control(s) paragraph. Such items include: encryption commodities controlled under ECCN 5A002; encryption software controlled under ECCN 5D002; and encryption technology controlled under ECCN 5E002. Refer to part 772 of the EAR for the definition of encryption items.
The following licensing policies apply to items identified in paragraph (a) of this section. Except as otherwise noted, applications will be reviewed on a case-by-case basis by BXA, in conjunction with other agencies, to determine whether the export or re-export is consistent with U.S. national security and foreign policy interests. For subsequent bundling and updates of these items see paragraph (n) of §770.2 of the EAR.
(iii) 64-bit mass market encryption commodities and software. Mass market encryption commodities and software with key lengths not exceeding 64-bit for the symmetric algorithm may be eligible for classification by BXA under ECCNs 5A992 or 5D992. Refer to the Cryptography Note (Note 3) to Part 2 of Category 5 of the CCL for a definition of mass market commodities and software. Key exchange mechanisms, proprietary key exchange mechanisms, or company proprietary commodities and software implementations may also be eligible for this treatment. Refer to Supplement No. 6 to part 742 and §748.3(b)(3) of the EAR for additional information.
(iv) For classification of these encryption items under these ECCNs, mark NLR in Block 9: Special purpose, on form BXA-748P, of your classification request.
(2) Encryption commodities and software eligible for classification under ECCNs 5A002 and 5D002. Items classified by BXA as retail products under ECCNs 5A002 and 5D002 are permitted for export and re-export to any end-user. All other encryption commodities and software, including components, classified by BXA under ECCNs 5A002 and 5D002 may be exported to any individual, commercial firm or other non-government end-user. Any encryption item (including technology classified under 5E002) will be permitted for export or re-export to U.S. subsidiaries (as defined in part 772). Products developed using U.S. encryption items are subject to the EAR. No exports are authorized to Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria.
(3) Encryption Licensing. Applicants may submit license applications for exports and re-exports of encryption items not eligible for export under license exception in unlimited quantities for all destinations except Cuba, Iran, Iraq, Libya, North Korea, Sudan or Syria, including exports and re-exports of encryption technology to strategic partners of U.S. companies (as defined in part 772). For Encryption Licensing Arrangements, the applicant must specify the sales territory and class of end-user. Encryption Licensing Arrangements are valid for four years and may require reporting. Licenses required for exports of encryption items to governments, or internet and telecommunications service providers for the provision of specific services to governments may be favorably considered for civil uses, e.g. social or financial services to the public, civil justice, social insurance, pensions and retirement, taxes and communications between governments and their citizens. Applications for the export and re-export of all other encryption items will be reviewed on a case-by-case basis.
(n) Interpretation 14: Encryption commodity and software reviews. Classification of encryption commodities or software is required to determine eligibility for all licensing mechanisms except source code (see S.740.13(e) and (a)(5)(i)) or exports to subsidiaries of U.S. firms (see 740.17(a)(1)). Note that subsequent bundling, patches, upgrades or releases, including name changes, may be exported or re-exported under the applicable provisions of the EAR without further technical review as long as the functional encryption capacity of the originally reviewed encryption product has not been modified or enhanced. This does not extend to products controlled under a different category on the CCL.
Asymmetric algorithm. (Cat 5, part II) A cryptographic algorithm using different, mathematically-related keys for encryption and decryption. A common use of asymmetric algorithms" is key management.
Encryption Component. Any encryption commodity or software (except source code), including encryption chips, integrated circuits, application specific encryption toolkits, or executable or linkable modules which alone are incapable of performing complete cryptographic functions, and is designed or intended for use in or the production of another encryption item.
(b) this term does not include the following public entities: utilities (including telecommunications companies and Internet service providers); banks and financial institutions; transportation; broadcast or entertainment; educational organizations; civil health and medical organizations; retail or wholesale firms; and manufacturing or industrial entities not engaged in the manufacture or distribution of items or services controlled on the Wassenaar Munitions List.
Open Cryptographic Interface. A mechanism which is designed to allow a customer or other party to insert cryptographic functionality without the intervention, help or assistance of the manufacturer or its agents, e.g., manufacturers signing of cryptographic code or proprietary interfaces. If the programmatic interface to the cryptographic hardware or object code software has a fixed set of cryptographic algorithms, key lengths or key exchange management systems that cannot be changed, it will not be considered an open cryptographic interface. All general application programming interface (i.e. those that accept either a cryptographic or non-cryptographic interface but do not themselves maintain any cryptographic functionality) will not be considered open cryptographic interfaces.
Related Controls: See also 5A992. This entry does not control: a.) "Personalized smart cards "where the cryptographic capability is restricted for use in equipment or systems excluded from control paragraphs b through f of this note. Note that if a "personalized smart card" has multiple functions, the control status of each function is assessed individually; b.) Receiving equipment for radio broadcast, pay television or similar restricted audience television of the consumer type, without digital encryption except that exclusively used for sending the billing or program-related information back to the broadcast providers c.) Portable or mobile radiotelephones for civil use (e.g., for use with commercial civil cellular radio communications systems) that are not capable of end-to-end encryption; d.) Equipment where the cryptographic capability is not user-accessible and which is specially designed and limited to allow any of the following: 1.) Execution of copy-protected "software"; 2.) Access to any of the following: a.) Copy-protected read-only media; or b.) Information stored in encrypted form on media (e.g., in connection with the protection of intellectual property rights) where the media is offered for sale in identical sets to the public; or 3.) One-time encryption of copyright protected audio/video data; e.) Cryptographic equipment specially designed and limited for banking use or money transactions; f.) Cordless telephone equipment not capable of end-to-end encryption where the maximum effective range of unboosted cordless operation (i.e., a single, unrelayed hop between terminal and home base station) is less than 400 meters according to the manufacturer's specifications.
Related Definitions: 1.) The term "money transactions" in paragraph e.) of Related Controls includes the collection and settlement of fares or credit functions. 2.) For the control of global navigation satellite systems receiving equipment containing or employing decryption (i.e., GPS or GLONASS) see 7A005.
3. "Cryptography" does not include "fixed data compression or coding techniques.
5B002 Information Security - test, inspection and "production" equipment.
5E002 "Technology" according to the General Technology Note" for the "development", "production" or "use" of equipment controlled by 5A002 or 5B002 or "software" controlled by 5D002.
Memorandum of that date. Refer to §742.15 of the EAR.
2. Note: The General Software Note does not apply to "software" controlled by Category 5 -part 2 ("Information Security"). For "software" controlled by Category 5, part 2, see Supplement No. 1 to part 774, Category 5, part 2, Note 3 - Cryptography Note.
Classification requests for encryption items must be submitted on Form BXA-748P, in accordance with Section 748.3 of the EAR. Insert in Block 9: Special Purpose of the Form BXA-748P, the phrase License Exception ENC or NLR, based on your classification request. Failure to insert this phrase will delay processing. In addition, the Bureau of Export Administration recommends that such requests be delivered via courier service to: Bureau of Export Administration, Office of Exporter Services, Room 2705, 14th Street and Pennsylvania Ave., N.W. Washington, D.C. 20230. In addition, you must send a copy of the request and all supporting documents to: Attn: ENC Encryption Request Coordinator, 9800 Savage Road, Suite 6131, Fort Meade, MD 20755-6000.
(a) Requests for encryption items will be processed in thirty (30) working days from receipt of a properly completed request.
(A) Description of all encryption algorithms and key lengths, e.g. source code, and how the algorithms are used. If any combination of different algorithms are used in the same product, also state how each is applied to the data.
(B) Pre-processing information of plaintext data before encryption (e.g. compression of the data).
(C) Post-processing information of cipher text data after encryption (e.g. packetization of the encrypted data).
(5) Include a complete description of all functionalities and their accessibility.
(6) Encryption components need to be clearly identified to include the name of the manufacturer, component model number, or other identifier.
(1) If applicable, reference the executable product that has already received a technical review.
(2) Include whether the source code has been modified by deleting the encryption algorithm, its associated key management routine(s) and all calls to the algorithm from the source code, or by providing the encryption algorithm and associated key management routine(s) in object code with all calls to the algorithm hidden. You must provide the technical details on how you have modified the source code.
(3) Include a copy of the sections of the source code that contain the encryption algorithm, key management routines, and their related calls.
(A) Description of encryption algorithm, if any combination of different algorithms are used in the same product, also state how each is applied to the data.
(B) Description of public key algorithm or symmetric key algorithm, (e.g. source code, is used to encrypt keys and the applicable key space).

References: §740
 §742
 §748
 §748
 §740
 §770
 §748
 §742