🚀 go-pugleaf

Several people have made incorrect statements about French laws on
cryptography.  I already posted detailed references in this newsgroup
two months ago (28 Oct), but it might be useful to post them again:

  The "decret du 18 avril 1939" defines 8 categories of arms and munitions
  from most dangerous (1st category) to least dangerous (8th).

  The "decret 73-364 du 12 mars 1973" specifies that cryptography
  equipment belongs to the second category. Any usage of such equipment
  requires authorization from the Prime minister. The authorization
  cannot be given to people who have committed a crime, or to alcoholic
  people. (If you want to encrypt your email, don't drink :-)

  The "decret 86-250 du 18 fev 1986" extends the definition of
  cryptography equipment to include software. It specifies that each
  request for authorizing professional *OR PRIVATE* usage of the
  equipment must be sent to the minister of the PTT (telecommunications).
  The request must include a complete and detailed description of the
  "cryptologic process", and if this is materially possible, of two
  copies of the envisaged equipment. My understanding is that
  "cryptologic process" only means the encryption algorithm, but not the
  secret key.

  The "loi 90-1170 du 29 decembre 1990" states that export *OR USE*
  of encryption means must be
  - previously declared when used only for authentication
  - previously authorized by the Prime minister in all other cases
  The fines go up to 500 000F (about $100,000) and three months
  in jail.

  The French law is much more restrictive than in the US, since I think
  it legal (up to now!) in the US to use encryption without prior
  authorization from the government. However the French law does not
  seem to be enforced at all.


Now some comments on previous postings.

gerben@rna.indiv.nluug.nl writes:

>France:
>  A law has been passed, stating you need a permit to use cryptohgraphic  
> soft- or hardware. But the law is not in effect yet, because they
> still have been  unable to think of a workable scheme to implement
> it. So currently, it is legal, but it might become illegal as soon
> as the implementation has been arranged.

This is incorrect. A law is in effect as soon as it is published in
the "Journal Officiel". The "loi du 29 dec 1990" has been published on
Dec 30th, 1990 and is consequently in effect.


Claus Tondering <ct@dde.dk> writes:

> I don't get this. If cryptographic SW or HW is illegal, how do you define
> cryptography. If I invent another character set and translate from ASCII
> to this new character set, will I be breaking French law? [...]
> What about binary files? How can anyone tell the difference between a
> binary file (containing, for example, a compiled version of a program)
> and an encrypted text?

Art. 28 of the above mentioned law (29 dec 1990) defines cryptography
in the following terms:

  A cryptologic process is defined as any process designed to transform
  using secret conventions a clear information or signal into an information
  or signal unintelligible by third parties, or to perform the inverse
  operation, using means, hardware or software conceived for this purpose.

Alternate character sets and compiled programs clearly do not fall in
this category.


Vesselin Bontchev <bontchev@fbihh.informatik.uni-hamburg.de> writes:

> I've heard strange things about France - that even the import of
> encrypted information is prohibited (unless to passes the country in
> transit, which is allowed), but I do not it for sure, so I am unable
> to comment on it.

Import of encryption *equipment* (not encrypted data) is prohibited by
the "decret du 18 avril 1939", art. 11. However the "loi du 29 dec 1990"
only restricts use or export, not import. There are no restrictions
on import of encrypted data.

Jean-loup Gailly
jloup@chorus.fr