My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on the latest release of FreeBSD.
They will not give us the algorithm for encrypting or decrypting the data sent to/received from their service. They probably have a secret key embedded in the compiled file.
The example website code they provide indicates that this stand-alone executable only does encryption and decryption of the data sent over the wire.
As part of our security review, we would like to find out does the compiled file only do the encryption/decryption or does it send information to another site/service.
Are there any US precedents or laws governing reverse engineering of foreign company obtained code for security reviews?