I have a LOB app that allows users to encrypt files with a specified password. Hashing is used to derive a fixed length-key which is then used by AES to encrypt the content. (It also uses HTTPS and the native keychain, but both of these are exempt anyway).
From what I understand, this is actually not an exempt from the US export regulation since I use encryption, but not for the sake of any of the points specified in f ("support of entertainment, mass commercial broadcasts or medical records management").
However, if I take the questionnaire provided by App Store Connect, it actually just prompts me with I reminder that I am required to file a report to the US Gov if I use HTTPS, and not the usual file upload I would expect.
I figured that what triggers this outcome is this question:
Does your app implement any encryption algorithms that are proprietary or not accepted as standards by international standard bodies (IEEE, IETF, ITU, etc.)?
I chose 'No', since AES is specified by the IETF. The upload prompt only appears when I choose 'Yes' here. I really don't understand how using standardized algorithm should free me from filing a report, and apple's documentation only makes this infinitely more confusing.
My conclusions would be:
I just leave
ITSAppUsesNonExemptEncryption on 'No' (which apple suggests but seems wrong to me).
I file a report to the US Gov anyway as Apple is out of line here.
Q: Are my assumptions right? An if so: If the described procedure does not require
ITSAppUsesNonExemptEncryption as YES, what even does?