I would like to know if implementing a hash function (such as MD5, SHA1 or SHA256) is legal.

  • Is it legal in the UK to implement a hash function and release it? (I know there's Regulation of Investigatory Powers Act but can it be released?)

  • In the US, do you just have to comply with exportation requirements or get your implementation licensed?

I am planning make a software but don't want to get involved with legal stuff.

  • 2
    "I am planning make a software but don't want to get involved with legal stuff." Then cryptography and protection of data is probably not the field you want to be developing for. – Ron Beyer Apr 9 at 15:16
  • @RonBeyer Virtually all modern software will implement some forms of cryptography, even if only to generate random numbers or verify a license. – forest Apr 10 at 6:50
  • @forest Yes, of course, but the OP's post makes it sound like they are creating a cryptography system, not just something that uses it. This is an entirely different ball-game as you may realize. If you create what you believe is a cryptographically secure hash function which later is found to be flawed and exposes data (not just in your system, but others), it can open you up to repercussions. – Ron Beyer Apr 10 at 12:23
  • @RonBeyer Implementing a hash function is not the same as creating a new cryptographic algorithm. – forest Apr 11 at 1:18

It is legal in the UK. In theory the government could demand that you insert a backdoor, but it isn't clear how it would work if you didn't have the technical ability to do it and what the liability would be when it was inevitably abused.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.