I would like to know if implementing a hash function (such as MD5, SHA1 or SHA256) is legal.

  • Is it legal in the UK to implement a hash function and release it? (I know there's Regulation of Investigatory Powers Act but can it be released?)

  • In the US, do you just have to comply with exportation requirements or get your implementation licensed?

I am planning make a software but don't want to get involved with legal stuff.

  • 2
    "I am planning make a software but don't want to get involved with legal stuff." Then cryptography and protection of data is probably not the field you want to be developing for.
    – Ron Beyer
    Apr 9, 2018 at 15:16
  • @RonBeyer Virtually all modern software will implement some forms of cryptography, even if only to generate random numbers or verify a license.
    – forest
    Apr 10, 2018 at 6:50
  • @forest Yes, of course, but the OP's post makes it sound like they are creating a cryptography system, not just something that uses it. This is an entirely different ball-game as you may realize. If you create what you believe is a cryptographically secure hash function which later is found to be flawed and exposes data (not just in your system, but others), it can open you up to repercussions.
    – Ron Beyer
    Apr 10, 2018 at 12:23
  • @RonBeyer Implementing a hash function is not the same as creating a new cryptographic algorithm.
    – forest
    Apr 11, 2018 at 1:18

1 Answer 1


It is legal in the UK. In theory the government could demand that you insert a backdoor, but it isn't clear how it would work if you didn't have the technical ability to do it and what the liability would be when it was inevitably abused.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .