Re: Debian Linux OS /// Urgent
On mar., 2011-01-11 at 15:58 +0100, Yves-Alexis Perez wrote:
> (with my ANSSI hat on)
>
> On mar., 2011-01-11 at 10:32 +0100, Treuil, Malvina (GE Healthcare,
> consultant) wrote:
> > Dear Madam, Dear Sir, The company I work for GEHC buys the software
> > containing the following encryption mean : Debian Linux.
> > I would like to check with you if this encryption mean have already
> > been declared to the French authorities (ANSSI). If yes, could you
> > please provide me with the ANSSI declaration file number and copy? As
> > we need to have them in case of an audit in France.
>
> Debian Project didn't made any declaration for crypto stuff to the
> French authorities. For reference, crypto supply and import are free
> (but subject to declaration), while export (from France) can be subject
> to authorization *if it's easy for an end user to change the embedded
> crypto*, else it's only declaration. More info can be found at
> http://www.ssi.gouv.fr/site_rubrique58.html (in French)
>
> I (with my Debian hat) did the declaration for supply/import/export (on
> the basis that changing the crypto usually needs a recompilation, which
> is not immediate for an end user, so it's not “easy” in the original
> sense).
>
> The official declaration should be available soon, I'll keep you posted.
Sorry it took so long. The declaration file number is 1101027. Scans of
the various documents are available at
http://people.debian.org/~corsac/anssi/ (in French).
It might be a good idea to put those somewhere on the website (not sure
if we have a place for that though) in case other people will need it.
Obviously, the timing is not perfect, as I'll have to make another
declaration for Squeeze when it's out, but I though it was a good idea
to have it first for Lenny, since the requester needed it right now and
people will still use Lenny for some time.
If you have any question, please ask.
--
Yves-Alexis
Reply to: