hi, I'm trying to submit my wallet application into ovistore. It uses aes encryption to protect data. It is using OpenSSL library.

Because it is using encryption, they ask me to provide a copy of:

A copy of the commodity classification ruling (CCATS) confirming classification of the content under ECCN 5D992, as a mass market encryption item under section 742.15(b)(2) of the Export Administration Regulations OR a copy of the “Notification” described in 742.15(b)(1), must be attached.

My english it's not enought to understand legal documentation.

First question will be, i really have to submit it if I using OpenSSL included into n900?

Is there any body who can indicate to me which steps I have to follow? Or how / where to start?

Thank's

you may want to ask here:
http://discussion.forum.nokia.com/fo...US-export-Laws

Is that qtwallet, under GPLv3? If so it's exempt from the Wassenaar agreement control list under the "In the public domain" provisions.

Strange that they are using the USA regulations for this, considering that neither Ovi nor you are in there (so no export from the USA is taking place). It looks like a huge misunderstanding on Ovi's part to me, maybe you can ask them to clarify why they require this. FWIW that regulation is here.

in the thread i linked to above, somebody said:

sounds to me like "we know these laws don't apply, but it's better to follow US laws anywhere in the world so they don't close down your offices there".

I was facing the same problem with MeePasswords.
I wrote an e-mail to developer.support@nokia.com asking for advice and they sent me these links:

http://www.bis.doc.gov/encryption/enc_faqs.htm
http://www.bis.doc.gov/encryption/742supp5.pdf
http://www.bis.doc.gov/encryption/question2.htm
http://www.bis.doc.gov/encryption/decision_tree.pdf

In general they were very helpful and even offered further assistance with this process.


Personally I found the decision tree very helpful: http://www.bis.doc.gov/encryption/decision_tree.pdf
With this you can easily identify what regulation applies to your software.
In my case, as MeePasswords is Open Source, I chose the option "Self Classify as 5D002. See License Exception TSU (740.13(e)) for notification requirement".
According to 740.13(e) http://www.gpo.gov/fdsys/pkg/CFR-200...-sec740-13.pdf I then send a notification to crypt@bis.doc.gov and enc@nsa.gov
I then attached a printed PDF of this notification e-mail via the form in the Nokia store. I am still waiting for response from the Nokia store QA. I will let you know how it worked out.

Please note that this is just my personal experience and no legal advice. You are still responsible to check everything yourself. However, I hope that these pointers are useful for some of us.