(with my ANSSI hat on) On mar., 2011-01-11 at 10:32 +0100, Treuil, Malvina (GE Healthcare, consultant) wrote: > Dear Madam, Dear Sir, The company I work for GEHC buys the software > containing the following encryption mean : Debian Linux. > I would like to check with you if this encryption mean have already > been declared to the French authorities (ANSSI). If yes, could you > please provide me with the ANSSI declaration file number and copy? As > we need to have them in case of an audit in France.
Debian Project didn't made any declaration for crypto stuff to the French authorities. For reference, crypto supply and import are free (but subject to declaration), while export (from France) can be subject to authorization *if it's easy for an end user to change the embedded crypto*, else it's only declaration. More info can be found at http://www.ssi.gouv.fr/site_rubrique58.html (in French) I (with my Debian hat) did the declaration for supply/import/export (on the basis that changing the crypto usually needs a recompilation, which is not immediate for an end user, so it's not “easy” in the original sense). The official declaration should be available soon, I'll keep you posted. Regards, -- Yves-Alexis Perez ANSSI/ACE/LAM
signature.asc
Description: This is a digitally signed message part
