Mailing-List: contact ooo-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: ooo-dev@incubator.apache.org
MIME-Version: 1.0
In-Reply-To: 
 <CAKTa1mj_vj708SeRTa=ZcN4aBLNVd+HbBWyndmpf88qpQ3skxg@mail.gmail.com>
References: 
 <CAP-ksojaTvK1J3zr=Nx2a2B2WRVNNsZORhR7UaLz=swiVtUDwQ@mail.gmail.com>
	<4E5E3E79.6080206@gmx.net>
	<00c701cc67fb$193ca9c0$4bb5fd40$@acm.org>
	<CAP-ksojXhs0czS7Wmw7HKRZMBmz1PoG4OudZJ=1RZ_Ff3-PVWg@mail.gmail.com>
	<CALKqTu8ZcxbO3STDAxLkSpBuf0JNk_S86Np7TbcE7BgAv_X3TA@mail.gmail.com>
	<CAP-ksogjvGGGnT0FMDtoDQCU3KCZv_JN=SRoYLwPA4y0zXqpMQ@mail.gmail.com>
	<CAFWMYEG8fTcS=bbuRv7om+x7dM7LPR3dg_fzDcfRcWikC0J-_Q@mail.gmail.com>
	<CAP-ksoiy5yEPZU8rtU9+j8aJgQ4PO0gv0TE5OxMXCsT3k=TrxA@mail.gmail.com>
	<CAFWMYEEGkFQFUBzhVQTge_AfCQ31a40LPHUFDs8LB=6HNkYWTQ@mail.gmail.com>
	<CAP-ksoh9Ot2Jkx-N+fFd+cLoxsqT__ubY3Q2Z_yFTnxkA-aPGQ@mail.gmail.com>
	<1314933101.93069.YahooMailNeo@web161425.mail.bf1.yahoo.com>
	<CAKTa1mj_vj708SeRTa=ZcN4aBLNVd+HbBWyndmpf88qpQ3skxg@mail.gmail.com>
Date: Fri, 2 Sep 2011 11:00:31 -0400
Message-ID: 
 <CAP-ksog1ixOWyohjU_=vAgX9MeTJyZmE7aUhtW-ZKjrrkaLshg@mail.gmail.com>
Subject: Re: Request dev help: Info for required crypto export declaration
From: Rob Weir <robweir@apache.org>
To: ooo-dev@incubator.apache.org
Content-Type: text/plain; charset=UTF-8

Starting fresh.  The more I look into this the more I'm starting to
think that the Apache export control instructions [1] are leading us
in the wrong direction.

>From what I've been able to determine, the classification code comes
not only from the strength of the encryption, but also the use of the
software.  For example, strong encryption (based on key length) might
end up in different classifications depending on whether it is a
general purpose encryption library, a "mass market" product, a server
product, etc.  It is not just about key length.

The Apache instructions seem to say that all paths lead to 5D002.
Maybe this is true for strong encryption in the typical Apache
developer libraries or server-side products.  But OpenOffice.org is
not your typical Apache product, is it?

If you look at how commercial derivatives of OpenOffice.org are
treated, such as IBM Lotus Symphony or LibreOffice Novell Edition, you
see that they are classified as 5D992, not 5D002.  But I do not see
5D992 mentioned at all on the Apache page on handling cryptography.
Until we better understand that discrepancy, I don't think we should
blindly follow the 5D002 route.

Is there anyone at Apache who really understands these things in a
more general way, e.g., understands the implications of "mass market"
software?

-Rob

[1] http://www.apache.org/dev/crypto.html