RE: Debian Linux OS /// Urgent
Dear Sir,
Thank you very much,
Best regards,
Malvina Treuil
Consultant Contrôle Commerce International
International Trade Control Consultant
Global Supply Chain
GE Healthcare
T +33 1 30 70 75 36
F +33 1 30 70 98 90
E malvina.treuil@ge.com
283 rue de la Minière
78530 Buc France
GE imagination at work
-----Original Message-----
From: Yves-Alexis Perez [mailto:corsac@debian.org]
Sent: Friday, January 21, 2011 3:04 PM
To: debian-project@lists.debian.org
Cc: Treuil, Malvina (GE Healthcare, consultant)
Subject: Re: Debian Linux OS /// Urgent
On mar., 2011-01-11 at 15:58 +0100, Yves-Alexis Perez wrote:
> (with my ANSSI hat on)
>
> On mar., 2011-01-11 at 10:32 +0100, Treuil, Malvina (GE Healthcare,
> consultant) wrote:
> > Dear Madam, Dear Sir, The company I work for GEHC buys the software
> > containing the following encryption mean : Debian Linux.
> > I would like to check with you if this encryption mean have already
> > been declared to the French authorities (ANSSI). If yes, could you
> > please provide me with the ANSSI declaration file number and copy?
> > As we need to have them in case of an audit in France.
>
> Debian Project didn't made any declaration for crypto stuff to the
> French authorities. For reference, crypto supply and import are free
> (but subject to declaration), while export (from France) can be
> subject to authorization *if it's easy for an end user to change the
> embedded crypto*, else it's only declaration. More info can be found
> at http://www.ssi.gouv.fr/site_rubrique58.html (in French)
>
> I (with my Debian hat) did the declaration for supply/import/export
> (on the basis that changing the crypto usually needs a recompilation,
> which is not immediate for an end user, so it's not "easy" in the
> original sense).
>
> The official declaration should be available soon, I'll keep you posted.
Sorry it took so long. The declaration file number is 1101027. Scans of the various documents are available at http://people.debian.org/~corsac/anssi/ (in French).
It might be a good idea to put those somewhere on the website (not sure if we have a place for that though) in case other people will need it.
Obviously, the timing is not perfect, as I'll have to make another declaration for Squeeze when it's out, but I though it was a good idea to have it first for Lenny, since the requester needed it right now and people will still use Lenny for some time.
If you have any question, please ask.
--
Yves-Alexis
Reply to: