united-states cryptography
Can I self-classify my app for mass market encryption if I let the user choose the encryption scheme?
<p>I am trying to get a mobile app published in the App Store. The app makes use of several standard encryption schemes (such as AES, Twofish, Serpent) provided by statically-linked OpenSSL and Crypto++ libraries, and it lets the user choose a preferred scheme for the app to use.</p>

<p>Turns out this "freedom of choice" is complicating an otherwise simple process of self-classification under the mass market encryption category and getting my CCATS.
I am not a lawyer, so I followed <a href="https://www.zetetic.net/blog/2009/8/3/mass-market-encryption-ccats-commodity-classification-for-ip.html" rel="nofollow">this link</a>.</p>

<p>However, the <em>Letter of Explanation and Supplement No. 1 to Part 774 Note 3 Cryptography Responses</em> template contains this </p>

<blockquote>
  <p>b.  The cryptographic functionality cannot be easily changed by the user;</p>
</blockquote>

<p>and then, the <em>Technical Specification and Supplement No. 6 to part 742 Responses</em> template contains this </p>

<blockquote>
  <p>(10) State how the product is written to preclude user modification of the encryption algorithms, key management and key space.</p>
</blockquote>

<p>and</p>

<blockquote>
  <p>(11) License Exception ENC 'Restricted' commodities and software described by the criteria in §740.17(b)(2) require licenses to certain “government end-users.” Describe whether the product(s) meet any of the §740.17(b)(2) criteria.  Provide specific data for each of the parameters listed, as applicable (e.g., maximum aggregate encrypted user data  throughput, maximum number of concurrent encrypted channels, and operating range for wireless products). If the §740.17(b)(2) parameters are not applicable to the commodity or
  software, clearly explain why, (e.g., by providing specific data evaluated against the §740.17(b)(2) thresholds.)</p>
  
  <p>APPLICATION does not meet 740.17(b)(2) criteria because: 
  It is not Network Infrastructure Software, 
  It does not provide Encryption Source code, 
  It has not been adapted for Government End Users 
  <strong>It does not allow any customization of cryptographic function for specific end users or by end users themselves</strong> 
  It does not provide cryptanalytic functionality 
  It does not provide or use quantum cryptography</p>
</blockquote>

<p>Does this mean I cannot use the Mass Market Encryption category when applying for CCATS? Just because I want to let users choose between AES and Twofish in the Settings? 
Any suggestion on how to deal with this, or a small legal advice, would be greatly appreciated.</p>

<p>It seems that the encryption functionality consists of giving the user a choice of different algorithms, letting the user pick one, and using that algorithm to encrypt the data. </p>

<p>It seems that functionality cannot easily be changed, or can it? </p>
