I have a LOB app that allows users to encrypt files with a specified password. Hashing is used to derive a fixed length-key which is then used by AES to encrypt the content. (It also uses HTTPS and the native keychain, but both of these are exempt anyway).

From what I understand, this is actually not an exempt from the US export regulation since I use encryption, but not for the sake of any of the points specified in f ("support of entertainment, mass commercial broadcasts or medical records management").

However, if I take the questionnaire provided by App Store Connect, it actually just prompts me with I reminder that I am required to file a report to the US Gov if I use HTTPS, and not the usual file upload I would expect.

I figured that what triggers this outcome is this question:

Does your app implement any encryption algorithms that are proprietary or not accepted as standards by international standard bodies (IEEE, IETF, ITU, etc.)?

I chose 'No', since AES is specified by the IETF. The upload prompt only appears when I choose 'Yes' here. I really don't understand how using standardized algorithm should free me from filing a report, and apple's documentation only makes this infinitely more confusing.

My conclusions would be:

I just leave ITSAppUsesNonExemptEncryption on 'No' (which apple suggests but seems wrong to me). I file a report to the US Gov anyway as Apple is out of line here.

Q: Are my assumptions right? An if so: If the described procedure does not require ITSAppUsesNonExemptEncryption as YES, what even does?


You must log in to answer this question.

Browse other questions tagged .