title: CCATS on iOS AppStore and encryption
body: <p>This is going to be one long question... Actually a set of related questions... 
  I want to make an iOS app, that will be sold on Apples App Store, (obviously). My app will store some sensitive user data in the documents directory. For security reasons I thought of a cryptosystem that will secure that data. Here the fun starts... That data security mechanism will be virtually unbreakable. I will be using AES-128/256, TwoFish 128/256 and Serpent 128/256. The user can select what to use where... I may be using dual encryption, data being encrypted once with AES and then with Serpent, or any combination of thous. </p>
  
  <p>I obviously need to check the "uses encryption" button on the app store. The problem is:</p>
  
  <p><strong>1) what certification do I need CCATS or just ERN?</strong></p>
  
  <p>From :</p>
  
  <p><a href="http://tigelane.blogspot.ro/2011/01/apple-itunes-export-restrictions-on.html" rel="noreferrer">http://tigelane.blogspot.ro/2011/01/apple-itunes-export-restrictions-on.html</a> </p>
  
  <blockquote>
    <ol>
    <li>Go to this link and use his instructions.  This is a great post: <a href="http://zetetic.net/blog/2009/08/03/mass-market-encryption-commodity-classification-for-iphone-applications-in-8-easy-steps/" rel="noreferrer">http://zetetic.net/blog/2009/08/03/mass-market-encryption-commodity-classification-for-iphone-applications-in-8-easy-steps/</a></li>
    <li>Do step 1 and 2 for all cases.  If you built your own encryption mechanism, that follow the entire post.  If you used SSL or other
    public domain encryption, then you can stop after you have your SNAP-R
    account.</li>
    </ol>
  </blockquote>
  
  <p>I need apparently to do the whole certification process... I definitely made my own mechanism.</p>
  
  <p><strong>2) Can the full CCATS be done 100% online?</strong> </p>
  
  <p>In that "8 easy steps" post it said I need to send some documents by (snail)mail. Then later on a user said that it is not necessary anymore. Note: those blog posts seem old (2 years).</p>
  
  <blockquote>
    <p>Excellent description! FYI: The process for obtaining a CIN/PIN for
    SNAP-R is now entirely electronic</p>
  </blockquote>
  
  <p>Another user said:</p>
  
  <blockquote>
    <p>You might want to consider updating your post. I've just been told by
    a BIS Counsellor that it's no longer necessary to snail mail in hard
    copies of your application form and supporting documentation. It may
    be something trivial to some but wasting $80 on international shipping
    is $80 down the drain.</p>
  </blockquote>
  
  <p>I hope I don't need to send all the documents by mail, as it will take a while to get them to the US from the EU. </p>
  
  <p>Has anyone in the EU used the ERN/ CCATS process recently? </p>
  
  <p><strong>3)I also saw that they ask you for a fax number... I don't have a fax. Is that a big problem?</strong></p>
  
  <p>If really necessary would an online fax service be ok?</p>
  
  <p><strong>4) Do i need to explain the whole encryption mechanism in detail? Or just the algorithms? Can I be rejected for having a "too good for mass market encryption cryptosystem" ?</strong></p>
  
  <p>Mostly, do I need to explain or declare that some data will be encrypted twice ? Or is " will store data encrypted on disk" a good enough explanation?</p>
  
  <p><strong>5) I will be using some password extension algorithms and hashing (HMAC, with SHA-2, maybe SHA-3)... do I need to report thous too?</strong></p>