Gideros Lua Encryption - could this create problems with export compliance?

moopf

A thought occurred to me today about Gideros' built-in Lua encryption - does using this require us to get an ERN (export registration with the US government)? It applies to all developers, not just those in the US looking to sell abroad, due to how Apple operate. I believe it may meet the exemptions provided by updated legislation in the US, specifically Category 5 Part 2 Note 4. Search for 'encryption' on the following page and you'll see the questions you have to answer:

http://developer.apple.com/library/ios/#documentation/LanguagesUtilities/Conceptual/iTunesConnect_Guide/8_AddingNewApps/AddingNewApps.html

Also, Category 5 Part 2 and Note 4 are explained here: http://www.bis.doc.gov/encryption/question1.htm

And then we have the whole French thing as well, which is outlined here in something that Apple sent out in 2011:

"Starting in the first week of July, apps that meet the following criteria are required to comply with French Encryption Laws/Regulations if you intend to distribute your app in France.

This requirement applies to apps that use, access, implement, or incorporate:

(a) any encryption algorithm that is yet to be standardized by international standard bodies such as IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA, etc. or not otherwise published; or

(b) standard (e.g., AES, DES, 3DES, RSA) encryption algorithm(s) instead of or in addition to accessing or using the encryption in iOS and/or Mac OS X

Apple will require you to upload a copy of your approved French declaration when you submit your app to the App Store.

Relevant French encryption regulations can be found at:

http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000005789847&dateTexte=#LEGIARTI000006421577

http://www.ssi.gouv.fr/archive/fr/reglementation/regl_crypto.html

http://www.ssi.gouv.fr/site_article195.html

http://www.ssi.gouv.fr/site_article197.html

Regards,

Apple Export Compliance"

So @atilim can you comment on this please so I know where we stand if I use the Lua encryption both in terms of US export restrictions and French laws. I know you're not a lawyer but presumably you paid notice to these laws when incorporating the encryption?

Cheers,

Gareth

ar2rsawseen

If I were @atilim I'd probably implement Lua encryption, because it was a requested features, thinking that feature squeakers would know better themselves, just saying

moopf

@ar2rsawseen - If that was the case then the release notes and documentation should include a caveat to that effect highlighting what encryption is used and that it may make your app require export certification.

Mells

@moopf
I didn't know about those laws either.
I have checked the documents that are required (France), and it's a big pain.
If you have to go through this (and I will myself probably take another path now that I know), really, good luck

atilim

Hi,

According to this chart http://www.bis.doc.gov/encryption/flowchart1.pdf if the encryption functionality is limited to intellectual property or copyright protection functions then it is exempt from the review. And the only purpose of Lua encryption in Gideros is to protect your intellectual property (your code).

I don't know the rules exactly but it seems it's safe.

moopf

Thanks @atilim - that's what I thought but wanted to check. No idea about France though, I need to find out more information on that.

fxone

@Atilim BTW: is the easy way to read *.lua.jet files under Android after extracting from apk? I couldn't find any tool for that. I assume that is possible (it needs probably proper text coding), but it looks like some kind of protection :-)

Teranth

Yeah the whole encrypting thing is a huge pain, hopefully that is correct and since it is protecting our IP we are okay. It's such a pain to even figure out what those documents actually say

atilim

@fxone It's hard to read. They are compiled Lua bytecodes and although there are some tools like LuaDec https://github.com/sztupy/luadec51 these tools doesn't give good results. And if you're a paid user, Lua bytecodes are also encrypted which makes reading them even harder.

fxone

@Atilim so lua.jet files are obfuscated enough even in free version. I have some idea.

Can we use:

googlebilling:setPublicKey("YourAppPublicKey")

as a part of response from event:

Event.CHECK_BILLING_SUPPORTED_COMPLETE

without purchasing item? I wonder if we can make an equivalent for LVL Google Licensing based on Google Billing plugin. Proguard (android obfuscator) seems to do not work with Gideros, so java files remain open for piracy practices. With Google Licensing plugin solution you could easily make Gideros SDK even stronger...

Should I mention that Corona SDK users can't even dream about such idea like described above?

fxone

@Atilim @Ar2rsawseen May I please something similiar to this one:
http://docs.coronalabs.com/api/library/licensing/index.html

their newest build has it..

moopf

@fxone I asked about this a long time ago, it's not on the radar here. I even offered to pay somebody here to produce a plugin to do it (I'm not a Java developer) but nobody was interested.