I am trying to get a mobile app published in the App Store. The app makes use of several standard encryption schemes (such as AES, Twofish, Serpent) provided by statically-linked OpenSSL and Crypto++ libraries, and it lets the user choose a preferred scheme for the app to use.
Turns out this "freedom of choice" is complicating an otherwise simple process of self-classification under the mass market encryption category and getting my CCATS. I am not a lawyer, so I followed this link.
However, the Letter of Explanation and Supplement No. 1 to Part 774 Note 3 Cryptography Responses template contains this
b. The cryptographic functionality cannot be easily changed by the user;
and then, the Technical Specification and Supplement No. 6 to part 742 Responses template contains this
(10) State how the product is written to preclude user modification of the encryption algorithms, key management and key space.
and
(11) License Exception ENC 'Restricted' commodities and software described by the criteria in §740.17(b)(2) require licenses to certain “government end-users.” Describe whether the product(s) meet any of the §740.17(b)(2) criteria. Provide specific data for each of the parameters listed, as applicable (e.g., maximum aggregate encrypted user data throughput, maximum number of concurrent encrypted channels, and operating range for wireless products). If the §740.17(b)(2) parameters are not applicable to the commodity or software, clearly explain why, (e.g., by providing specific data evaluated against the §740.17(b)(2) thresholds.)
APPLICATION does not meet 740.17(b)(2) criteria because: It is not Network Infrastructure Software, It does not provide Encryption Source code, It has not been adapted for Government End Users It does not allow any customization of cryptographic function for specific end users or by end users themselves It does not provide cryptanalytic functionality It does not provide or use quantum cryptography
Does this mean I cannot use the Mass Market Encryption category when applying for CCATS? Just because I want to let users choose between AES and Twofish in the Settings? Any suggestion on how to deal with this, or a small legal advice, would be greatly appreciated.
