Encryption in Mac App Store apps..?

[Albin_Kiland]

I was going to submit an update to my app on Mac App Store today. Never thought about encryption as a “special case” until now.
When I choose “Ready to upload binary” Apple asks me If I’ve implemented any encryption in my app since the last update.

Have you added or made changes to encryption features since your last submission of this app?
Export laws require that products containing encryption must be properly authorized for export. Failure to comply could result in severe penalties. Learn more about export requirements.

The thing is I HAVE added encryption for one feature.
There’s a “Contact us…” feature that allows the user to send us an e-mail.
This feature actually calls a PHP script on our server that in turn does the actual sending of the email.
This PHP script receives the “data” for the email in an AES encrypted parameter and decrypts it to populate the e-mail.
The information is NOT STORED anywhere in it’s encrypted form.

Does this require me to answer “Yes” on Apples question? I would guess so?…
Apple gives this link to read: http://www.bis.doc.gov/index.php/policy-guidance/encryption

Any help here is greatly appreciated!
Don’t really know where to begin…

[Horst_Jehle]

I have an App in MAS that has a encrypted Database and use the keystore. I have answered “Yes” to the encrption question in MAS. The application was released without any question from Apple.

Show iTAN in AppStore.

[Albin_Kiland]

[quote=70494:@Horst Jehle]I have an App in MAS that has a encrypted Database and use the keystore. I have answered “Yes” to the encrption question in MAS. The application was released without any question from Apple.

Show iTAN in AppStore.[/quote]
Okay, that sounds promising
I did find the “Flowchart” that would determine if my app is controlled or not.
I’ve gotten down to “Part” 3: Is the product described by Note 4?" But I don’t really know what “Note 4” is…

[Walter_Zeidler]

I think this means that you not export encryption outside USA. You can store encryption data on a server in USA for a App in the US AppStore. But a App in USA should not store encryption data on a server in Irland etc. for example.

That was my understanding in 2012 for a iPhone App that save data with a very simple encryption on Dropbox. I mean a I sayed no and the app is in the store. I see that is a little bit scary.

[Walter_Zeidler]

Sorry, not only for a APP for US store. Your App will import to USA and USA will not that encryption export.

[Albin_Kiland]

This app does not store any encrypted data anywhere. It only transfers some data in an encrypted form to a PHP script on our server here in Sweden. This PHP script does not store it either, only decrypts it.

[Albin_Kiland]

Found “Note 4”. If my app meets all these requirements it would NOT be controlled under EAR.
Can’t make it out though. Anyone knowledgeable about this stuff?
As stated above the app doesn’t store anything. Only sends it to a script.

Note 4: Category 5, Part 2 does not apply to items incorporating or using “cryptography” and meeting all of the following:

(a) The primary function or set of functions is not any of the following:
(1) “Information security”;
(2) A computer, including operating systems, parts and components therefor;
(3) Sending, receiving or storing information (except in support of entertainment, mass commercial broadcasts, digital rights
management or medical records management); or
(4) Networking (includes operation, administration, management and provisioning);
(b) The cryptographic functionality is limited to supporting their primary function or set of functions; and
(c) When necessary, details of the items are accessible and will be provided, upon request, to the appropriate authority in the exporter’s
country in order to ascertain compliance with conditions described in paragraphs (a) and (b) above.

Note 4 completely removes the decontrolled items from control under Category 5, Part 2 of the CCL.

[Albin_Kiland]

Well, one way out of this is to use a simple Base64 encoding instead I guess?
It’s not really sensitive data beeing sent. It’s the users name, e-mail address and his/hers message.

[Albin_Kiland]

@70508:@Albin Kiland

Well, one way out of this is to use a simple Base64 encoding instead I guess?

I’ll do just that. Don’t have time for this.
Thanks for your assistance guys

[Walter_Zeidler]

Perhaps a US peoble or a lawyer can say more about this better. ;-).

I do things and I make that flexible and Apple can say yes or no ;-). Who have the time for check everything?