How to submit an app to Apple’s App Store when it uses encryption

Post by perlpimp » Tue, Jan 05, 2016, 11:36 AM UTC

rdtsc wrote: post #37

NamTaf wrote: post #5

Earlier quoted context omitted.

Holy crap that is a bureaucratic nightmare. Why does encryption even need to be registered in the first place? I don't see any point beyond the holdover of 'encryption is munitions' which is a pile of crap in the first place.

Because you might be exporting it to an un-friendly country. Don't try to apply logic here -- "But can't they just compile openssl or just use Linux!? or some library..." -- this is government contracting and security world, regular logic doesn't work here.

Post by dchest » Tue, Jan 05, 2016, 12:07 PM UTC

Rafert wrote: post #45

pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

This seems to be only for US based developers, I can't remember having to fill in more then a handful of radio buttons regarding crypto when I submitted an iOS app as a Dutch developer.

Post by supergirl » Tue, Jan 05, 2016, 12:49 PM UTC

Post by _up » Tue, Jan 05, 2016, 1:06 PM UTC

eclipxe wrote: post #14

eridius wrote: post #11

Earlier quoted context omitted.

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

Thank you! It is definitely a misinterpretation. Apple makes https mandatory now and there is no way every developer would have to go through this process.

Post by _up » Tue, Jan 05, 2016, 1:14 PM UTC

danieltillett wrote: post #46

comex wrote: post #35

Earlier quoted context omitted.

> Note 4: Category 5, Part 2 does not apply to items [...] meeting all of the following: > (a) The primary function or set of functions is not any of the following: [...] > ...... (3) Sending, receiving or storing information ( except in support of entertainment, mass commercial broadcasts, digital rights management or medical records management); (Emphasis mine.) Triple negative - now that's something. And DRM and t…

I would have thought that DRM is a loophole you can drive a truck through. As long as any of your data is of value, you can claim the reason for encryption is DRM. Even if you let the end user have access to all data, you could always send some sort of DRM heartbeat.