Export Control and App Store Distribution
This chapter describes the export control status of the Nevis Mobile Authentication SDK and of the third-party components it contains. It is relevant if you plan to distribute your application through an app store operated by a company that is subject to United States trade restrictions, in particular the Huawei AppGallery.
This chapter summarizes the export control status of the software Nevis delivers, to the best of our knowledge. It is not legal advice. The assessment of whether you may distribute your own application through a specific channel remains your responsibility and requires your own legal review.
Summary
| Component | Origin | Subject to the U.S. Export Administration Regulations (EAR) |
|---|---|---|
| Nevis Mobile Authentication SDK (core) | Switzerland | No |
| Open source dependencies | Various | No, see Third-party dependencies |
com.google.android.play:integrity | United States | Yes, optional dependency as of Android SDK 4.5.0 |
| Android app hardening framework | United States | Yes, ECCN 5D002 |
The practical consequence is described in Distribution through the Huawei AppGallery.
The Nevis Mobile Authentication SDK
The Nevis Mobile Authentication SDK is designed and developed by Nevis Security AG in Switzerland. The core SDK is therefore non-U.S. origin software.
- The core SDK is not subject to the U.S. Export Administration Regulations (EAR). It has no U.S. Export Control Classification Number (ECCN) and it is not classified as EAR99.
- The core SDK is governed by Swiss export control law, administered by the State Secretariat for Economic Affairs (SECO). It qualifies under the mass-market exemption for commercial cryptographic and information security items (Category 5, Part 2, Cryptographic Note 3).
This applies to both the debug and the release flavors, and to the Android and the iOS artifacts.
Third-party dependencies
The statements above cover the code written by Nevis. The artifacts that Nevis delivers also contain third-party components, which must be assessed separately.
iOS
The iOS artifact (NevisMobileAuthentication.xcframework) has no transitive third-party dependencies. The topic described in this chapter is therefore Android only.
Android open source dependencies
The debug and release flavors of the Android SDK have an identical dependency tree. All of these dependencies are publicly available open source software:
| Dependency | Publisher | Export control status |
|---|---|---|
com.squareup.okhttp3:okhttp | Square, Inc. (United States) | Published open source, excluded from the EAR under 15 CFR 734.7 |
com.google.code.gson:gson | Google LLC (United States) | Published open source, excluded from the EAR under 15 CFR 734.7 |
com.ryanharter.auto.value:auto-value-gson-runtime | Ryan Harter (United States) | Published open source, excluded from the EAR under 15 CFR 734.7 |
androidx.annotation:annotation | Google LLC (United States) | Published open source, excluded from the EAR under 15 CFR 734.7 |
com.google.dagger:dagger | Google LLC (United States) | Published open source, excluded from the EAR under 15 CFR 734.7 |
org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcpkix-jdk15to18 | Legion of the Bouncy Castle Inc. (Australia) | Non-U.S. origin, not subject to the EAR |
com.nimbusds:nimbus-jose-jwt | Connect2id (Bulgaria) | Non-U.S. origin, not subject to the EAR |
Google Play Integrity
The com.google.android.play:integrity library is a proprietary library owned by Google LLC (United States) and is subject to the EAR. The SDK uses it for application attestation.
As of Android SDK 4.5.0, this library is no longer a transitive dependency of the SDK. Applications that use application attestation must declare it explicitly, as described in SDK Configuration. Applications that do not use application attestation can omit the dependency entirely, which removes this library from the build.
Note that the Play Integrity API relies on Google Mobile Services (GMS). On devices that ship with Huawei Mobile Services (HMS) instead of GMS, the API is not available at runtime.
The Android app hardening framework
The Android SDK is delivered pre-hardened. The hardening framework used for this is a commercial product of a third-party vendor.
The vendor of the hardening framework has confirmed that its software is U.S.-origin software, subject to the U.S. Export Administration Regulations, and classified under ECCN 5D002.
The vendor further stated that, under its current compliance posture, it cannot support the deployment of its software to the Huawei AppGallery, because Huawei Technologies is listed on the Entity List of the U.S. Department of Commerce. This applies regardless of where the development or the upload takes place.
Because the hardening framework is part of the delivered Android SDK, this status carries over to every application that embeds the SDK.
Distribution through the Huawei AppGallery
Nevis does not support the distribution of applications that embed the Nevis Mobile Authentication SDK for Android through the Huawei AppGallery.
If you want to distribute your application through the Huawei AppGallery nevertheless, you need an independent legal review on your side. Nevis is not in a position to authorize or endorse such a distribution.
What this restriction is not
- It is not a device restriction. Whether the SDK runs on a given Huawei device is a separate question, described in Supported platforms. An application distributed through the Google Play Store can run on a Huawei device that provides Google Mobile Services.
- It is not a general restriction for app stores in China. App store operators that are not listed on the Entity List of the U.S. Department of Commerce are not affected by this specific restriction. Other constraints may still apply to them, for example the availability of Google Mobile Services or local data protection requirements.
- It does not affect iOS. The iOS artifact does not contain the Android app hardening framework.
Options
If you must publish to the Huawei AppGallery, contact Nevis support to discuss the available options. Nevis is evaluating alternatives, such as a hardening framework from a non-U.S. vendor and a distribution model in which the application vendor applies its own hardening to an unhardened SDK. No commitment on availability or timing can be made at this point.