Encryption code

A discussion forum for JFreeChart (a 2D chart library for the Java platform).
Locked
marcus
Posts: 3
Joined: Fri Feb 04, 2011 12:27 pm
antibot: No, of course not.

Encryption code

Post by marcus » Fri Feb 04, 2011 5:28 pm

Hi everybody,

I know you do not like the question, but some people need answers, because they would like to use your software.

Does JFreeChart and JCommon contain any encryption source code?

The problem is, that if you or somebody else exports your libraries or sources and the sources contain
U.S.-originated encryption code then the sources need an U.S. export license.

If your sources do not contain any relevant encryption, everything is fine.
There are also some exceptions to the relevance of encryption.

If they do contain relevant encryption code, there seem to be an easy way to get an Export License Exception,
I can give you a hint where to find the interesting paragraph in the U.S. export regulations.
I have read too much of those documents in the last weeks to get some information
how to handle exports.

I am no U.S. citizen, I am a German guy, and we have all the same problem.
I do not like those regulations, but we have to find solutions.


Best regards,

Marcus

marcus
Posts: 3
Joined: Fri Feb 04, 2011 12:27 pm
antibot: No, of course not.

Re: Encryption code

Post by marcus » Mon Feb 07, 2011 11:54 am

Hi,

sorry to be imprecise.
I am talking about software code that uses encryption algorithms or functions.

Best regards,

Marcus

marcus
Posts: 3
Joined: Fri Feb 04, 2011 12:27 pm
antibot: No, of course not.

Re: Encryption code

Post by marcus » Fri Mar 11, 2011 3:06 pm

Hi everybody,
mmicky30 wrote:If your sources do not contain any relevant encryption, everything is fine.
That's wrong, sorry, simply the usage of encryption functions may create new encryption items/products , which may be U.S. export controlled.
mmicky30 wrote:There are also some exceptions to the relevance of encryption.
Yes, that's right. If JFreeChart uses any encryption or encryption items, I think JFreeChart may be excepted from U.S. export regulations by Note 4 of the EAR 774 - Commerce Control List - Category 5 - Part II. "Information Security":
Note 4: Category 5, Part 2 does not apply to items incorporating or using “cryptography” and meeting all of the following:
a. The primary function or set of functions is not any of the following:
1. “Information security”;
2. A computer, including operating systems, parts and components therefor;
3. Sending, receiving or storing information (except in support of entertainment, mass commercial broadcasts, digital rights management or medical records management); or
4. Networking (includes operation, administration, management and provisioning);
b. The cryptographic functionality is limited to supporting their primary function or set of functions; and
c. When necessary, details of the items are accessible and will be provided, upon request, to the appropriate authority in the exporter's country in order to ascertain compliance with conditions described in paragraphs a. and b. above.
But I would like to have an official statement about usage of encryption, encryption items or that Note 4 is applicable to JFreeChart :-)


Best regards,

Marcus

Taqua
JFreeReport Project Leader
Posts: 698
Joined: Fri Mar 14, 2003 3:34 pm
Contact:

Re: Encryption code

Post by Taqua » Sun Mar 13, 2011 3:46 pm

JFreeChart nor JCommon contain any encrypting codes. Heck, they do not originate from the US either, as except for US people no one cares about that panic making stuff.

Of course, the JDK contains encryption libraries and thus your *overall* product may be problematic if you ship a JRE. But as usual: Never trust anonymous voices on a forum, go grab a lawyer, go grab someone to look at the code and then fill out the forms.
Read my Blog for the latest Pentaho Report Designer Tips and Tricks.

seess
Posts: 2
Joined: Mon Mar 14, 2011 12:58 pm
antibot: No, of course not.

Re: Encryption code

Post by seess » Mon Mar 14, 2011 1:00 pm

Taqua wrote:JFreeChart nor JCommon contain any encrypting codes. Heck, they do not originate from the US either, as except for US people no one cares about that panic making stuff.

Of course, the JDK contains encryption libraries and thus your *overall* productr4 may be problematic if you ship a JRE. But as usual: Never trust anonymous voices on a forum, go grab a lawyer, go grab someone to look at the code and then fill out the forms.
Yes, You are right. I have similar opinion. I am working on it.

Locked