Using SSL means you have to say your application uses cryptography?

Question

I'm almost ready to ship the Windows 8 Store app to the store. As part of this process, you must answer the question :

Does your application support, support, contain or use cryptography or encryption?

The following features are listed below:

• Any use of a digital signature, such as authentication or integrity verification
• Encryption of any data or files that your application uses or uses.
• Key management, certificate management, or anything that interacts with a public key infrastructure.
• Using a secure communication channel such as NTLM, Kerberos, Secure Sockets Layer (SSL), or Transport Layer Security (TLS)
• Encryption of passwords or other forms of information security
• Copy Protection or Digital Rights Management (DRM)
• Antivirus protection

(emphasis mine.) There are some exceptions:

• Password encryption
• Copy protection
• Authentication
• Digital Rights Management
• Using digital signatures

My application was originally a Windows Phone application with limited ability to store or export data locally, so we have functionality to back up or restore with SkyDrive. (For the purposes of this question, the fact that SkyDrive may soon change its name does not matter.) We are putting the same feature in the Windows Store app. Connecting to SkyDrive https - in other words, we use SSL.

Does this mean that I need a commodity classification code (ECCN)? Really?

Answer 1

From this page Understanding the restrictions on exporting cryptography , it looks like the answer is yes, SSL is counted if you do not transport content over the wire. But I'm not a lawyer.

Does your application support, support, contain or use cryptography or encryption?

This question will help you determine if your application uses the type of cryptography that is governed by the Export Administration Rules. The question includes examples from this list; but remember that this list does not include all the possible uses of cryptography.

It is important . When you answer this question, consider not only the code that you wrote for your application, but also all the software libraries, utilities, and operating system components that your application or links relate to.

• Any use of a digital signature, such as authentication or integrity verification
• Encryption of any data or files that your application uses or uses.
• Key management, certificate management, or anything that interacts with a public key infrastructure.
• Using a secure communication channel such as NTLM, Kerberos, Secure Sockets Layer (SSL) or Transport Layer Security (TLS)
• Encryption of passwords or other forms of information security
• Copy Protection or Digital Rights Management (DRM)
• Antivirus protection

For a complete and current list of cryptographic applications, see EAR controls for items that use encryption.

Is cryptography or encryption limited to one or more of the tasks listed here?

If you answered yes to the first question, then the second question lists some of the applications of cryptography that are not limited. Here are unlimited tasks:

• Password encryption
• Copy protection
• Authentication
• Digital Rights Management
• Using digital signatures

If your application calls, supports, contains or uses cryptography or encryption for any task that is not on this list, then your answer to this question is No.