Using SSL in an iPhone App - Export Compliance

Question

Hi,

This question isn't strictly development-related but I hope it's still acceptable :)

I'm looking at creating an iPhone app that will communicate with a REST Web service. Because some user-sensitive data (name, address, age, etc) will be transmitted I'm looking at securing the connections with SSL.

However, on my previous escapades into App Store submission, I saw that the first question I get asked is "Does your application use encryption?", and depending on the answer to this and other follow-up questions, may require US export compliance.

My company is not based in the US, nor do we have a US office.

Has anyone else submitted an app using SSL for this sort of purpose - and if so did you need to do anything to get permission to use it, either from Apple or from the US government?

Thanks in advance,

John

Answer 1

I strongly agree with Michael; if you did not write any encryption code, you're fine. You are using the libraries which were provided by the iPhone OS.

Answer 2

Hi all, Thanks for the info. I actually went back to Apple and it turns out that any application using SSL does need approval (unfortunately). There are apparently some exceptions, such as if the application uses SSL only for a single payment transaction.

There's more information on this here: http://www.zetetic.net/blog/2009/08/03/mass-market-encryption-commodity-classification-for-iphone-applications-in-8-easy-steps/

and here: http://blog.theanimail.com/iphone-encryption-export-compliance-for-apps

Good luck to anyone else in a similar position - I'm off to start writing a CCATS application...

John