Hacker News Reader

Comment by megous | Hacker News Reader

In other words, Signal is in the clear, because it's E2EE for all purposes and the operators wouldn't have the ability (via reasonable means) to access the data in the first place?

> - Provision of cryptology services to ensure confidentiality functions without a declaration of conformity,

Does signal declare conformity of its privacy crypto functions? (with what, anyway?)

View on HN

Declaration of conformity given out by the government.

France requires authorization for import/export of confidentiality providing cryptology SW (depending on the other country).

https://www.at-ica.com/encryption-in-france/

Anyway, with Telegram, what is the outher country? What is "import"? Someone using Telegram servers from France? Taking money from customers in France, for provison of service hosted potentially elsewhere? Someone in France being able to download Telegram client?

What about cryptographic tools distributed by Github in France? Do they have proper declarations? What about Linux distributions containing tools like openssl or pgp? It seems to me that a lot of illegal activity might be happening there.

Yes. The best situation for a government to be in - everybody is doing something that doesn't make any sense to be illegal but it is, so they can do whatever at any time they feel like so.

Personal or development use are excluded. Basically if you're selling your own crypto (or a tool with your own crypto) you have to license it. I have to look, but i'm pretty sure openssl is licensed (If you have ISO/IEC 9797 or something you're good)

Reply on news.ycombinator.com