Source: http://cryptome.org/jya/fr-decrees.htm
Timestamp: 2019-04-23 00:21:08+00:00

Document:
28 March 1999. Thanks to Pete Kaiser for translation of official publication in French (URLs below).
Decree number 99-199 of 17 March 1999 defining the categories of cryptologic devices and services for which the procedure of prior declaration is substituted for that of authorization.
Art. 1: - For each of the categories of cryptologic devices and services which figure in the first column of the table annexed to this decree, the operations for which the procedure of prior declaration is substituted for that of authorization are indicated in the second column of the same table.
Art. 2: - Decree number 98-207 of 23 March 1998, defining the categories of cryptologic devices and services for which the procedure of prior declaration is substituted for that of authorization, is repealed.
Art. 3: - This decree will be published in the Official Journal of the Republic of France.
Done in Paris, 17 March 1999.
Devices or software offering a service of confidentiality carried out by an algorithm whose key is of length less than or equal to 40 bits.
Devices or software offering a service of confidentiality carried out by an algorithm whose key is of length greater than 40 bits and less than or equal to 128 bits.
(1) Use and importation are not subject to declaration unless they concern a device or software which has not been previously declared by the producer, supplier, or importer, and if the said device or said software is not destined exclusively for the private use of a natural person.
(*) P: provide; U: use; E: export; I: import.
Decree number 99-200 of 17 March 1999 defining the categories of cryptologic devices and services dispensed from all prior formality.
Art. 1: - For each of the categories of cryptologic devices and services which figure in the first column of the table annexed to this decree, the operations dispensed from all prior formality are indicated in the second column of the same table.
Art. 2: - Decree number 98-206 of 23 March 1998, defining the categories of cryptologic devices and services dispensed from all prior formality, is repealed.
Devices or software offering a service of confidentiality carried out by an algorithm whose key is of length greater than 40 bits and less than or equal to 128 bits under the condition that either the said devices or software have previously been subject to a declaration by their producer, a supplier, or an importer; or that the said devices or software are destined exclusively for the private use of a natural person.
Personalized microprocessor cards, or their specially designed components, incapable of encrypting message traffic or data supplied by their user or their associated key-management service.
Mass-market television reception equipment without the capacity for digital encryption, or where digital decryption is limited to the video, audio, or management functions.
Portable or mobile radiotelephones destined for civilian use which do not perform end-to-end encryption.
Mass-market component digital videodisc players without the capacity of encryption, or where decryption is limited to the video, audio, information-processing, and management functions.
Hardware or software methods specially designed to protect software against copying or illicit use, whose decryption functions are not accessible to the user.
Access control equipment, such as automatic banknote distributors, self-service account statement printers or point of sale terminals, protecting passwords, personal identification numbers or other similar data preventing unauthorized access to such equipment, but not permitting the encryption of files or text, except when this is directly bound to the protection of passwords or personal identification numbers.
Devices or services designed to protect passwords, personal identification codes, or similar authentication data used to control access to data, resources, services, or locations, subject to the condition that they not permit encryption except of files of passwords or identification codes and the information necessary for access control.
Devices or services designed to carry out or protect a signature procedure, a cryptographic control value, a message authentication code or similar information, to verify the source of data, provide proof of origin to the recipient, or to detect surreptitious alterations or modifications bearing on the integrity of the data; except that they may permit the encryption only of the information necessary for authentication or an integrity check of the data concerned.
Billing systems included in the operations of counters whose encryption functions are bound directly to the counting.
Equipment capable of encryption accompanying foreign persons officially invited by the State.
And not permitting the application of cryptographic techniques to message traffic except over the radio interface.
Art. 1 - The dossier of declaration, or requesting authorization concerning a cryptologic device or service, consists of administrative part and a technical part.
The administrative part comprises a declaration or a request for authorization conforming to the model attached to this ruling, in three copies.
The technical part comprises a description conforming to the model attached to this ruling, in three copies. Accompanying this part are two examples of the device concerned; or, for software, one example.
Dossiers filed under the framework of the simplified declaration procedure envisaged in article 9 of the decree of 24 February 1998 mentioned above, as well as those filed for renewal of an authorization, are not included in the technical part. This is replaced by an undertaking written by the person filing the dossier, certifying either that the impossibility for the device or service to assure confidentiality functions does not result simply from a keying procedure, or that the technical characteristics of the device or service are unchanged with respect to the description given in the technical part of the dossier filed when the authorization was first granted.
Art. 2. - Any change that alters the contents of the dossier of declaration or request for authorization must be brought to the attention of the central service of information systems security at least a month in advance.
Art. 3. - The ruling of 13 March 1998, defining the form and contents of the dossier concerning declarations or requests for authorization relating to cryptologic devices and services, is repealed.
Art. 4. - The Secretary General of national defense is charged with enforcement of this ruling, which will be published in the Official Journal of the Republic of France.
(*) Reserved to the Administration.
(*) Specify the name(s) of the algorithm(s) used.
I, the undersigned (name, forenames) .................................... acting in my capacity as ....................................................... representative of the provider - exporter - importer - user (*) certify that the information in this declaration - request for authorization (*) is true and has been determined in good faith, any false declaration or any omission from the information provided exposing me to the penalties envisaged by article 28 of law 90-1170 of 29 December 1990 modified and by decree number 98-101 of 24 February 1998.
(*) Cross out inapplicable cases.
Either a complete description of the cryptologic procedures employed, in the form of a mathematical description and a simulation in a high-level language such as C or Pascal, or the reference to a previously filed dossier for a product using the same cryptologic procedure, or reference to a clear recognized standard whose technical details are easily and unconditionally accessible.
The description of post-treatment of encrypted data after their encryption (addition of a header, formatting, packetizing, etc.).
In accordance with the third paragraph of article 1 of the ruling above, the technical part must be accompanied by two examples of the device concerned, or by one example of the software concerned.
To be supplied only in case of a request for authorization.

References: Art. 1

Art. 2

Art. 3

Art. 1

Art. 2

Art. 1

Art. 2

Art. 3

Art. 4