united-states software encryption
Is it illegal in the US to release software containing cryptography if there is no master key or backdoor or data retention?
<p>If I made a proprietary piece of software that provided AES-256 encryption for IM, voice chat, and file transfer would this itself be illegal? The way it'd be set up is people would run the service entirely on their own. There would be no retention of data by 3rd party or even on the person's machine. It would be stored in memory for smallest time possible then dumped away. It would not be saved. There'd be no backdoor, master key, etc. The ONLY way to read the data would be to have a connection to the server with a valid key to read data sent from other people connected to it. It seems this is a project idea to keep on the shelves as in the US and all over the world something like this would be extremely illegal. The only way to obtain the key would be from the server operator him/herself, or if you knew someone who had a valid key that connects to that server and they shared it with you.</p>

<p>To clarify even more:</p>

<p>I want to know if itd be illegal to create and release a software that effectively encrypts internet communication such as IM and voice chat, and any file transfer end to end--in a context where there is no way to read the data unless your client has the key to decrypt received data in the event you are connected to a server, or intercepting data sent from clients or server and trying to decrypt it yourself with brute force. Those are the only 2 ways. Otherwise you'd have to lift the key somehow from the server machine or client machine in the event the person has their USB still plugged in(unless it's on harddrive of course)and you can somehow read from it from a remote location or acquire the Harddrive/USB itself or have access to the physical client's or serve machine itself. In other words, in the event of a police investigation regarding something that when on that was illegal during the use of the app... authorities would have to go to some pretty pretty great lengths to get anywhere. But they'd have to catch the crime happening live, as no text, voice, or file transfer data will EVER live on the server's harddrive or client's harddrive(just in memory as briefly as possible). The only other way would be screenshot. The only other way I can think of would be to catch suspect using the app, get their computer that has the app on it with key in place to use with the server, and get the people connected to the serve to somehow admit to crimes without them knowing the police are on the other side of this suspects client and not that person. Once again, some extreme lengths. I wouldn't want to be responsible for any of that. If people took it and used it for bad that needs to be their problem, not mine. If theres a chance I could owe money, or serve jail time, theres no way it's worth it. </p>

<blockquote>
  <p>Is it illegal in the US to release software containing cryptography if
  there is no master key or backdoor or data retention?</p>
</blockquote>

<p>No.</p>

<p>There are some kind of technologies, including certain kinds of cryptography, which are subject to <a href="https://www.state.gov/strategictrade/overview/" rel="nofollow noreferrer">export controls</a> under the <a href="https://en.wikipedia.org/wiki/Export_Administration_Act_of_1979" rel="nofollow noreferrer">Export Administration Act of 1979</a>. </p>

<p>But, whether or not there is a master key, backdoor, or data retention is not the criteria for export control. Instead, the criteria is basically based upon how hard the cryptography is for foreign intelligence agencies to crack. </p>

<p>For example, a three digit numeric code with no master key, backdoor or data retention is not going to be controlled technology.</p>

<p>Many cryptography applications that are subject to export control are also classified by the NSA, and are not known of, or available to, private sector firms for use in proprietary applications, something that would have been made clear to the firm if it was permitted to use those applications under license from the federal government.</p>

<p>I don't have the technical expertise to know whether or not <a href="https://www.techopedia.com/definition/29703/256-bit-encryption" rel="nofollow noreferrer">AES-256 encryption</a> is export controlled technology. The U.S. Department of Commerce regularly updates a list which is disseminated via regulation. In this case, the relevant list is the <a href="https://www.bis.doc.gov/index.php/regulations/commerce-control-list-ccl" rel="nofollow noreferrer">Commerce Control List (CCL)</a> in Category 5 part 2 (information security) and product group D (software). The full text of the relevant part of the CCL is <a href="https://www.bis.doc.gov/index.php/forms-documents/regulations-docs/2337-ccl5-pt2-10-24-18/file" rel="nofollow noreferrer">here</a> (although this actually just points you to more detailed sublists).</p>

<p>(The other two main lists are for nuclear materials and for munitions.)</p>
