Apple and encryption - Githubissues

0x0ece commented 6 years ago

Apple asks if we use encryption, and we may (or may not) need additional doc for that: https://itunespartner.apple.com/en/apps/faq/Managing%20Your%20Apps_Export%20Compliance

TODO:

understand if we need to provide additional docs
if so, prepare the docs
check what happens for android

@kalamaico this is a great task for you :)

kalamaico commented 6 years ago

Seen :)

kalamaico commented 6 years ago

@0x0ece what crypto stuff do we use exactly? sha-512, something else?

kalamaico commented 6 years ago

Ok, for what I could see:

we use hash functions. Does this qualify as "encryption"? (if we use encryption for real, then yes, we do :) ). If it does not, we should be safe from all the hassle (but the day we want to implement a vault, that changes)
encryption is limited within the OS (no idea what they think of, but we don't move encrypted data around), which means we qualify for some of the exemptions
We don't use proprietary algos, nor standard-to-be
We don't implement standard algos (we use what's provided by iOS I guess. No idea if we use an external lib, does that qualify as "implements"?)
I have no idea if you plan to release the app to France :)

0x0ece commented 6 years ago

We use a lib, but we should find a way to use the os because it's slow, so I guess we're good or we will be :)

What's the issue with France, is it forbidden?

0x0ece commented 6 years ago

Ah I missed the first q: sha256 and base64 for mempa. PBKDF2 for storing user's master password armored (to verify if it's correct).

https://github.com/0x0ece/yopa-native/blob/master/src/Crypto.js

kalamaico commented 6 years ago

I have no idea what US guys have with French, but it is one of the 5 questions (if you answer "YES" this question, you must submit an Import Declaration approval from French ANSSI authorities.) - don't even start to ask what is ANSSI authorities in France, it might have to deal with frogs. I would say:

yes we use crypto
it is limited within the OS
we use it for authentication only
we use iOS primitives

Will go over that crap again and see if I forgot something

0x0ece commented 6 years ago

Ok so in short we're good. Thanks for checking, closing this issue now.

kalamaico commented 6 years ago

Reopening, as we have to answer the questions and checking for Android :)

0x0ece commented 6 years ago

And Chrome then :)

kalamaico commented 6 years ago

To review the answers as we want to implement a vault

0x0ece / yopa-native

Apple and encryption #94