1

The OpenSSL license talks about crypto laws in various countries. I have seen many apps using https. So, do all of them take a license or something? What kind of license can I choose to give to take no liability (in case I distribute commercial software made with SSL).

  • Which country are you in? – MadHatter Oct 12 at 5:51
  • India I am in and I am mainly concerned about sending to US,EUisrael and Russia.(It will be just an app using https requests on play store). – compenthusiast Oct 12 at 6:06
2

Those crypto laws are typically not centered around copyright, which means that there is no copyright license, open-source or not, that can limit your liability when breaking those laws.

Those crypto laws are typically centered around the idea that having better cryptography that your enemy gives your military an advantage. And having a military advantage is a good thing when a war starts.
Those laws restrict the export of the actual cryptography software (i.e. the SSL library itself), but not of software that just uses a secure connection to protect its communication.

This means that if your app does not include the SSL library itself but rather asks the OS to create a secure connection for them, then the app is not restricted by the crypto laws.

If you do include the SSL library in your app (or implement cryptographic algorithms yourself), then you need to carefully look at the export laws for both your country and the countries where your repository and servers are hosted. You may need to restrict from which countries those servers can be accessed.
Licenses to export your app under the crypto laws do exist, but that is typically a license for a single sale.

| improve this answer | |
  • So does open SSL do it itself or ask the OS.One more thing many apps have ads ,those might be using https so do all those apps need a liscence or has Google taken one for Android? – compenthusiast Oct 12 at 9:20
  • Basically can I use OpenSSL in a closed source commercial app assuming appache v2 liscence with crypto software?Moreover games made in game engines supporting https should also come under this. – compenthusiast Oct 12 at 9:26
  • @compenthusiast, do you actively distribute OpenSSL with your app, or do you expect that Google or the device manufacturer has already installed it on the device? – Bart van Ingen Schenau Oct 12 at 11:01
  • I have actually not made an app yet. I will make and I want to know all legal aspects beforehand. I have mainly a want to implement HTTPS TLS to communicate between a server and the client.I will use the GODOT game engine(MIT) which uses mbedssl or write an openSSL plugin.My basic question is :::::::: If my app makes https requests does it need to get export liscence in India? ::::::::::: From chart on – compenthusiast Oct 12 at 11:27
  • 1
    @compenthusiast just so we're clear, 56 bit asymmetric encryption at this point is functionally equivalent to plaintext; over twenty years ago, you could brute-force a 56-bit key in three days. I recommend focussing on what Bart has to say about how exporting apps that link to good crypto libraries and exporting good crypto are not the same thing. – MadHatter Oct 13 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.