OpenSSL ECCN query
On the CGI IT UK Limited project I am currently working on, we are looking to export OpenSSL as part of the overall software deliverable. As part of this process, we need to know whether OpenSSL is of United States origin, and if so what the ECCN number is, and does an ENC licence also apply? I would be most grateful if you could provide me with this information. However, failing this, if you could direct me to where I might find the information I require this would also be very helpful. Your assistance with this matter is most appreciated. Best regards, Richard Richard Trebilcock | ILS Engineer Defence | CGI Chaucer House, Springfield Drive, The Office Park, Leatherhead, Surrey, KT22 7LP UK T: +44 01372 838258 | M: +44 (0) 7717 355882 richard.trebilc...@cgi.com | cgi-group.co.uk [cid:image001.jpg@01CE2A2B.EE6E9D30] CGI IT UK Limited. A CGI Group Inc. Company Registered Office: 250 Brook Drive, Green Park, Reading RG2 6UA, United Kingdom. Registered in England Wales - Number 947968 CONFIDENTIALITY NOTICE: Proprietary/Confidential Information belonging to CGI Group Inc. and its affiliates may be contained in this message. If you are not a recipient indicated or intended in this message (or responsible for delivery of this message to such person), or you think for any reason that this message may have been addressed to you in error, you may not use or copy or deliver this message to anyone else. In such case, you should destroy this message and are asked to notify the sender by reply e-mail. inline: image001.jpg
Re: OpenSSL ECCN query
On 12/09/2013 07:35 AM, Trebilcock, Richard wrote: On the CGI IT UK Limited project I am currently working on, we are looking to export OpenSSL as part of the overall software deliverable. As part of this process, we need to know whether OpenSSL is of United States origin, and if so what the ECCN number is, and does an ENC licence also apply? I would be most grateful if you could provide me with this information. However, failing this, if you could direct me to where I might find the information I require this would also be very helpful. OpenSSL is not of U.S origin, as in it was developed and is maintained outside of the U.S. by non-U.S. persons. I'm the only U.S. citizen or resident with any direct involvement in OpenSSL and I'm not part of the OpenSSL team proper (no commit privileges). However, be careful as U.S. export controls are tricky. If I download crypto from outside the U.S. and then immediately forward it to a non-U.S. destination then I may have committed an export control violation. So where the crypto came from initially isn't relevant, it's whether it leaves the U.S. Yes, that doesn't make any sense. But that's why you need to be very careful. You really need to consult with competent legal counsel specializing in export law. That said you may find Appendix F of the OpenSSL FIPS module User Guide of use: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140InProcess.pdf Keep in mind that the FIPS module is *not* the same as OpenSSL and that I'm not qualified to give legal advice. -Steve M. -- Steve Marquess OpenSSL Software Foundation, Inc. 1829 Mount Ephraim Road Adamstown, MD 21710 USA +1 877 673 6775 s/b +1 301 874 2571 direct marqu...@opensslfoundation.com marqu...@openssl.com gpg/pgp key: http://openssl.com/docs/0xCE69424E.asc __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
Re: OpenSSL ECCN query
RichardWhy are you asking us about the export status of OpenSSL?KenInterSoft International, Inc.Voice: 888-823-1541Fax: 866-701-1260http://www.netterm.comhttp://www.securenetterm.comFrom: "Trebilcock, Richard" richard.trebilc...@cgi.com To: "openssl-dev@openssl.org" openssl-dev@openssl.org Sent: Monday, December 9, 2013 6:35 AM Subject: OpenSSL ECCN query On the CGI IT UK Limited project I am currently working on, we are looking to export OpenSSL as part of the overall software deliverable. As part of this process, we need to know whether OpenSSL is of United States origin, and if so what the ECCN number is, and does an ENC licence also apply? I would be most grateful if you could provide me with this information. However, failing this, if you could direct me to where I might find the information I require this would also be very helpful. Your assistance with this matter is most appreciated. Best regards, Richard Richard Trebilcock | ILS Engineer Defence | CGI Chaucer House, Springfield Drive, The Office Park, Leatherhead, Surrey, KT22 7LP UK T: +44 01372 838258 | M: +44 (0) 7717 355882 richard.trebilc...@cgi.com | cgi-group.co.uk CGI IT UK Limited. A CGI Group Inc. Company Registered Office: 250 Brook Drive, Green Park, Reading RG2 6UA, United Kingdom. Registered in England Wales - Number 947968 CONFIDENTIALITY NOTICE: Proprietary/Confidential Information belonging to CGI Group Inc. and its affiliates may be contained in this message. If you are not a recipient indicated or intended in this message (or responsible for delivery of this message to such person), or you think for any reason that this message may have been addressed to you in error, you may not use or copy or deliver this message to anyone else. In such case, you should destroy this message and are asked to notify the sender by reply e-mail.
