Export from US of crypto software with key-size > 56 bits still needs permission? Elsewhere someone stated that he couldn't publish his crypto software on the Internet, because US Export Regulations require approval, if the key size is greater than 56 bits. I know that several decades ago there were such extremely rigorous restrictions. Could anyone kindly check whether that indeed remains so even today?
First of all, this is not legal advice. However, I've been in the unfortunate position where I've had to deal with this legal nightmare. The new agreement which regulates export of cryptography internationally is called the Wassenaar Arrangement. If your product is what is called a mass market product, i.e available for purchase to the general public without restriction, you can ignore any export restrictions. You can also skip this if your software is open source and available for free for everyone. There's more exclusions such as if your only use is in DRM , if the input to the cryptographic algorithms can no be changed.

If you restrict your sales to a select subset of customers or if your product is exclusionary in some attribute, e.g price is too high to be considered mass market, you need to contact your local government body responsible for Wassenaar compliance. 

The section you would be interested in is DUAL-USE LIST - CATEGORY 5 – PART 2 – "INFORMATION SECURITY".

If you feel you might fall under this arrangement it's best to follow the following rules:


If your encryption is based on a symmetric algorithm, keep the key size at 56 bits or less. (e.g AES, DES, Blowfish...)
If your encryption is based on the difficulty of factoring integers, keep the key size at 512 bits or less. (e.g RSA)
If your encryption is based on the difficulty of computing discrete logarithms in a multiplicative group of a finite field, keep the size at 512 bits or less. (e.g Diffie Hellman over Z/pZ)
If your encryption is based on discrete logarithms in a group other mentioned previously, keep the size at 112 bits or less. (e.g Diffie-Hellman over an eliptic curve)


If you do not follow these rules you will come under control of the government body responsible for Wassenaar compliance. Which is extremely likely to become a huge bureaucratic burden on your organization as export controls are extremely poorly set up to deal with things like software where you may have many thousands of customers. It is best to avoid it unless cryptography is an integral part of your product. Most companies and individuals are unaffected by the arrangement as it tries to be narrow enough to only capture the companies which trade with foreign governments.

If your system does any sort of cryptoanalytic work it's generally considered even more sensitive and your odds of being in export controlled territory increases.