Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way.

When I started the process of getting the ERN, I quickly notice it was going to be a long and arduous process and that other people could benefit from the lessons I was learning the hard way, so I decided to document it all in a long blog post.

This is probably one of my most researched pieces ever. The whole process took about two months from the start, researching this thing called ERN, to getting the app published in the Mac App Store, satisfying that what I did was (more or less) correct.

At the same time Apple encourages the use of HTTPS with App Transport Security (ATS).

   Starting in iOS 9.0 and OS X v10.11, a new security feature 
   called App Transport Security (ATS) is available to apps and is 
   enabled by default. It improves the privacy and data integrity 
   of connections between an app and web services by enforcing 
   additional security requirements for HTTP-based networking 
   requests. Specifically, with ATS enabled, HTTP connections must 
   use HTTPS (RFC 2818). Attempts to connect using insecure HTTP 
   fail. Furthermore, HTTPS requests must use best practices for 
   secure communications.

https://developer.apple.com/library/ios/documentation/Genera...

Does that mean that in the future nearly every App will need the ERN?

I read this entire article thinking it was overly elaborate satire, but there was no punch line at the end, and the links are actually valid.

The TP pool memo[1] in Neal Stephenson Snow Crash seems sane by comparison.

[1] http://soquoted.blogspot.com/2006/03/memo-from-fedland.html

Not everything that "just uses HTTPS" necessarily needs ERN. Here's "note 4" which exempts a lot of apps: http://www.bis.doc.gov/index.php/policy-guidance/encryption/...

A big part of our app was "sending, receiving, and storing information", so we weren't sure this exemption would apply to us. So, we did the ERN anyway, and it took a couple of days calendar time, and a couple of hours of working time, IIRC.

By the way, nowhere does it say that using HTTPS is fine if you just use Apple's APIs and frameworks. I don't think it's relevant here.

Great guide. If you are into these sort of guides of how to deal with the US government I have written a couple for the W8-BEN-E form [1] (you need this if you have any US customers) and also for registering to do business with the US government [2]. These are biased towards Australians, but they should be helpful for others too.

1. http://www.tillett.info/2015/06/20/how-to-complete-w-8ben-e-...

2. http://www.tillett.info/2015/12/01/how-to-register-an-austra...

Not specific to Apple. Same thing has to be done for any other app store, like Google's. Some mentioned that there is an exception if you use OS libraries for encryption. I think that's not the case, but I think using some third party SDKs like Game Center (for which I guess the providers did the paper work) is excepted.

How is this different from Android apps distributed through Google Play? Legally I mean, why don't Google Play do the same thing?

If I inform everyone that their iOS app uses AES, SHA-1, and RSA at the lowest level (codesign and Fairplay DRM), does everyone have to register? I think a plain reading of the question poised by Apple would require a "Yes" answer.

For cross reference, here is another list of steps based on our experience. It took about 3 days.

https://www.chatmap.io/blog/iPhone-iTunes-ERN-Encryption.php

Which cryptographic algorithms are included in Atom Electron and NW.js frameworks? Does the page [1] list all of them?

[1] https://www.chromium.org/blink/webcrypto

ignoring anything else, that process seemed pretty smooth to me, esp for government. Sure you hit a few snags, but the main one (a lost email) could've happened signing up anywhere.

How does this apply to non-US based app publishers?

Am I legally exporting crypto from the US if am not in the US?

Don't you wish you hadn't surrendered software distribution authority to a single faceless corporate party? When nobody tried to demand bullshit crypto paperwork?

Remember when you could distribute software yourself without getting threatened[1]? Remember when platform vendors didn't take a 30% cut of everything you earned just because they wrote an OS? Not even Microsoft was that evil.

I hope you enjoy the world you've built, hipsters.

[1] See the f.lux Apple distribution debacle