Imported from previous forum
[ original email was from Ryan Pierce - rpierce@taltrade.com ]
One function of the working group is to work towards creating open source reference implementations. Previously, export of cryptography was very tightly restricted. Fortunately, the US has loosened its export restrictions on cryptography such that we can now post open source implementations on the web as long as we notify the Commerce Department.
The specific rules are posted below.
§740.13
TECHNOLOGY AND SOFTWARE –
UNRESTRICTED (TSU)
e) Unrestricted encryption source code
(1) Encryption source code controlled under 5D002, which would be
considered publicly available under §734.3(b)(3) and which is not
subject to an express agreement for the payment of a licensing
fee or royalty for commercial production or sale of any product
developed with the source code, is released from "EI" controls
and may be exported or reexported without review under License
Exception TSU, provided you have submitted written notification
to BXA of the Internet location (e.g., URL or Internet address)
or a copy of the source code by the time of export. Submit the
notification to BXA and send a copy to ENC Encryption Request
Coordinator (see §740.17(g)(5) for mailing addresses).
Intellectual property protection (e.g., copyright, patent or
trademark) will not, by itself, be construed as an express
agreement for the payment of a licensing fee or royalty for
commercial production or sale of any product developed using the
source code.
(2) You may not knowingly export or reexport source code or
products developed with this source code to Cuba, Iran, Iraq,
Libya, North Korea, Sudan or Syria.
(3) Posting of the source code on the Internet (e.g., FTP or
World Wide Web site) where the source code may be downloaded by
anyone would not establish "knowledge" of a prohibited export or
reexport, including that described in paragraph (e)(2) of this
section. In addition, such posting would not trigger "red flags"
necessitating the affirmative duty to inquire under the "Know
Your Customer" guidance provided in Supplement No. 3 to part 732
of the EAR.