# Is it legal to develop a cipher breaker software?

Is it legal to develop a cipher-breaker software/algorithm? What about it's legality in India?

• I don't see anything wrong with that. As long as you don't use the program to harm others, there's no reason for it to be illegal.
– Evan Su
Apr 11 at 12:35
• I, and others, have reservation about legal questions being on-topic (especially when about present laws), see this meta. And I know enough about laws on cryptography to advise NOT to follow random advice about them, as laws and consequences for violating them vary considerably. Apr 11 at 12:40
• Legality aside, is it credible to rely on start-ups or individual developers who couldn't help themselves with regulation compliance issues? Apr 11 at 13:29
• Generically "a cipher breaker software" attempts to perform what an encryption software is trying to make impossible: making an encrypted piece of data (e.g. text, image, voice, video) intelligible without the key (think: password or other secret) that, by design of the encryption, should be necessary. Example applications, among many: Eavesdrop on wifi or internet communication. Help law enforcement to decode communications between gangsters, or vice versa. Make files encrypted by a cryptoransomware intelligible again, without paying the ransom. Apr 11 at 19:09

This is going to depend very much on just what sort of encrypted content such software is used to decrypt. For example, if this allows the user to circumvent an access control mechanism to copyright-protected content, it may be unlawful under the anti-circumvention provisions fc the US Digital Millennium Copyright Act (DMCA). If it is used to gain access to confidential communications transmitted electronically, it may be unlawful under various "wiretapping" laws.

To the best of my knowledge there is no law making the development of a code breaking program illegal. But some uses of such a program would be. And if a program was distributed or marketed for such uses, that distribution might itself be unlawful.

This is also, if stated in a general way, a very hard problem. Any well-designed cryptographic system will have a sufficiently large keyspace to make brute-force search impractical. Other known attacks require at least one of: access to a very large volume of encrypted text; access to significant volume of encrypted text and matching clear text; interception of key-distribution channels; interference with key distribution; knowledge of properties of the key-generation system. In short more than just a "program" is needed, and if a modern competently implemented cryptographic system is involved, more than just ciphertext. Obtaining cleartext or other inputs may require unlawful techniques

• It doesn't have to be a modern cipher necessarily; I'm sure it would be legal to write a ROT13 breaker. Apr 12 at 22:30
• @belkarx See law.stackexchange.com/a/79307/17500 on the CFAA. Unless the breaker program is being used to access real data, which almost surely means data protected by real modern encryption. no one will prosecute. Apr 13 at 2:01

I would say, that a cipher-breaking software can also be counted as a hacking tool. Therefore the paragraphs concerning hacking apply. Most countries handle this in such a way that only the use against non-consenting third parties is liable to prosecution. As far as I know, India handles this in the same way. This implies that creation and usage with the consent of the parties involved is not a punishable act.

There may be articles unknown to me which provide the context in which said act is illegal. Privileges are also possible for explicit legality in other contexts (e.g. for scientists). Also, local laws or even practical jurisprudence could handle this differently. In addition, most countries have a lively change in their digital media laws, which should also be taken into account. Therefore, one should always do extensive research for one's own context.

The only country I know that criminalises the creation of hacking software is Germany. $$\S$$ 202c StGB is known as the "Hacking Paragraph" and prohibits the creation of such software. But as mentioned above, this paragraph is highly contested and the associated jurisprudence is not as straightforward as the wording of the paragraph may suggest.

• According to your logic, since OS like Windows or MacOS can be used for hacking, they should also be considered as hacking tools and Microsoft and Apple should stop development and distribution of their OSes. Apr 11 at 12:49
• Such implications and criticisms have been raised by many German security researchers. Simply put, this criticism was ignored, the law was maintained despite legal uncertainties and some companies in the field even left the country. This is exactly why I said that jurisdiction and the law can be different.
– Titanlord
Apr 11 at 12:56
• Making malware is legal if it is for research purposes, as is cipher breaking. Hacking (by US law, at least), requires "unauthorized access". Cipher breaking which would be the action of creating a piece of software and not the action of an unpermitted attack, would not be hacking nor would it be illegal. Apr 12 at 22:29