OpenDrop - App Store Export Compliance Documentation

Encryption Overview

Summary of Encryption Usage

What OpenDrop Does NOT Use

• Proprietary encryption algorithms
• Custom cryptographic implementations
• Modified versions of standard algorithms
• Encryption not accepted by international standards bodies
• Government-specific encryption features

Mobile App Encryption

Platform: iOS & Android (Flutter/Dart)

1. Firebase Authentication

Library: firebase_auth (Flutter)
Purpose: User authentication and session management
Encryption: TLS 1.2/1.3 (platform-provided)
Standards: OAuth 2.0 (RFC 6749), JWT (RFC 7519)

Usage in Code:

• auth_service.dart: Firebase Auth for user sign-in
• ID token generation and refresh
• Cross-platform user identification

2. Google Sign-In

Library: google_sign_in (Flutter)
Purpose: OAuth 2.0 authentication with Google
Encryption: TLS via platform SDK
Standards: OAuth 2.0 (RFC 6749, RFC 6750)

Usage in Code:

• auth_service.dart: GoogleSignIn class for OAuth flow
• Credential exchange with Firebase

3. RevenueCat (In-App Purchases)

Library: purchases_flutter
Purpose: Subscription management and purchase verification
Encryption: TLS 1.2/1.3 (SDK-provided)
Standards: HTTPS, platform billing APIs

Usage in Code:

• subscription_service.dart: Subscription status checking
• main.dart: SDK initialization
• config.dart: API key configuration

4. HTTP Communication (Dio)

Library: dio (Dart)
Purpose: API calls to OpenDrop desktop server
Encryption: TLS via platform SSL/TLS stack
Standards: HTTPS (RFC 2818)

Usage in Code:

• api_service.dart: All server communication
• file_uploader.dart: Chunked file uploads
• Session token and API key transmission

5. QR Code Scanning

Library: mobile_scanner
Purpose: Scan QR codes for connection setup
Encryption: None (camera input only)

Note: QR scanning itself does not use encryption. The scanned data (connection URL and secret) is transmitted over HTTPS.

Mobile Encryption Summary Table

Desktop Server Encryption

Platform: Python (Windows, macOS, Linux)

1. HTTPS Communication

Library: requests (Python)
Purpose: Sync data to Cloudflare Worker
Encryption: TLS 1.2/1.3 via OS SSL stack
Standards: HTTPS (RFC 2818)

Usage in Code:

• cloud_sync.py: sync_to_cloud(), _heartbeat_loop()

2. OAuth 2.0 Authentication

Library: google-auth-oauthlib
Purpose: Google Sign-In for desktop
Encryption: TLS via requests library
Standards: OAuth 2.0 (RFC 6749, RFC 6750)

Usage in Code:

• auth.py: Credential management and token refresh

3. Cloudflare Tunnel

Binary: cloudflared
Purpose: Secure tunnel exposing local server
Encryption: QUIC with TLS 1.3
Standards: QUIC (RFC 9000), TLS 1.3 (RFC 8446)

Usage in Code:

• tunnel.py: Tunnel initialization and management

4. Session Management

Implementation: Server-generated tokens
Purpose: Authenticated session continuity
Transmission: HTTPS headers

Usage in Code:

• middleware.py: Session validation
• health.py: Session creation

Server Encryption Summary Table

Third-Party SDKs

SDK Encryption Attestations

All third-party SDKs use standard encryption provided by their respective platforms and comply with international encryption standards.

Export Compliance Questionnaire

U.S. Export Administration Regulations (EAR) Responses

Q1: Does your app use encryption?

Yes

Q2: Does your app qualify for any exemptions provided in Category 5, Part 2 of the EAR?

Yes - Mass market exemption under EAR 740.17(b)(1)

Q3: Does your app implement any proprietary or non-standard cryptographic algorithms?

No - All encryption uses industry-standard algorithms

Q4: Does your app only use encryption provided by the operating system?

No - The app uses additional standard third-party libraries, but all implement standard algorithms

Q5: Is your app available without restriction?

Yes - Available to general public

Q6: Is the encryption user-configurable?

No - Users cannot modify encryption settings

Q7: Is your app designed for government use?

No - Consumer file sharing application

Exemption Qualification

App Store Connect Submission Guide

Step-by-Step Answers

When submitting your app to App Store Connect, you will be asked about export compliance. Use these answers:

Screen 1: Export Compliance

"Does your app use encryption?"

Select: Yes

Screen 2: Exemption Qualification

"Does your app qualify for any of the exemptions provided in Category 5, Part 2 of the U.S. Export Administration Regulations?"

Select: Yes

Screen 3: Encryption Type

"Does your app contain, use, or access third-party encryption?"

Select: Yes

"Does your app implement or use cryptography that is proprietary or not accepted as standard by international standard bodies (IEEE, IETF, ITU, etc.)?"

Select: No

Screen 4: Distribution

"Is your app going to be available on the French App Store?"

Select: Yes (app qualifies for all territories)

Annual Self-Classification Report

If required, use BIS classification:

• ECCN: 5D992
• License Exception: ENC (740.17(b)(1))

Declaration Statement

For Apple App Store Review

OpenDrop version 0.6.91 uses encryption exclusively for:

1. Secure network communication via HTTPS using standard TLS 1.2/1.3 protocols
2. User authentication via OAuth 2.0 (Google Sign-In) and Firebase Authentication
3. In-app purchase verification via RevenueCat SDK using platform billing APIs
4. Secure tunneling via Cloudflare's publicly available tunnel software
5. JWT token handling for session management using standard RFC 7519 format

No proprietary encryption algorithms are implemented. All cryptographic functionality is provided by:

• Apple's Security framework and App Transport Security
• Firebase SDK (Google)
• RevenueCat SDK
• Platform-provided TLS/SSL implementations

This application qualifies for the mass market encryption exemption under U.S. Export Administration Regulations section 740.17(b)(1).

For Google Play Console

OpenDrop uses encryption for secure data transmission only. All encryption is provided by:

• Android platform TLS/SSL
• Firebase Authentication SDK
• RevenueCat Purchases SDK
• Standard HTTPS for API communication

No custom or proprietary encryption algorithms are used.

Technical Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│                        OPENDROP SYSTEM                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌─────────────────┐         HTTPS/TLS          ┌────────────┐  │
│  │   Mobile App    │◄──────────────────────────►│  Firebase  │  │
│  │   (Flutter)     │         OAuth 2.0          │   Auth     │  │
│  └────────┬────────┘                            └────────────┘  │
│           │                                                     │
│           │ HTTPS/TLS                                           │
│           │                                                     │
│           ▼                                                     │
│  ┌─────────────────┐         HTTPS/TLS          ┌────────────┐  │
│  │   RevenueCat    │◄──────────────────────────►│   Store    │  │
│  │      SDK        │                            │   APIs     │  │
│  └─────────────────┘                            └────────────┘  │
│                                                                 │
│  ┌─────────────────┐      TLS 1.3/QUIC          ┌────────────┐  │
│  │  Desktop Server │◄──────────────────────────►│ Cloudflare │  │
│  │    (Python)     │         Tunnel             │   Edge     │  │
│  └────────┬────────┘                            └────────────┘  │
│           │                                                     │
│           │ HTTPS/TLS                                           │
│           ▼                                                     │
│  ┌─────────────────┐                            ┌────────────┐  │
│  │   Cloudflare    │◄──────────────────────────►│   Mobile   │  │
│  │     Worker      │         HTTPS/TLS          │    App     │  │
│  └─────────────────┘                            └────────────┘  │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────┐    │
│  │                  ENCRYPTION STANDARDS                   │    │
│  │  • TLS 1.2/1.3 (IETF RFC 8446)                          │    │
│  │  • OAuth 2.0 (IETF RFC 6749)                            │    │
│  │  • JWT (IETF RFC 7519)                                  │    │
│  │  • HTTPS (IETF RFC 2818)                                │    │
│  │  • QUIC (IETF RFC 9000)                                 │    │
│  └─────────────────────────────────────────────────────────┘    │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

All connections use standard encryption - NO proprietary algorithms

Appendix A: Code File Encryption Reference

Mobile App Files

Desktop Server Files

Appendix B: Compliance Checklist

Before submission, verify:

• ✓ All encryption uses standard algorithms (TLS, OAuth, JWT)
• ✓ No proprietary encryption implemented
• ✓ Third-party SDKs use standard encryption
• ✓ App is available to general public
• ✓ No government-specific features
• ✓ Users cannot modify encryption settings
• ✓ Documentation prepared for App Store Review
• ✓ ECCN classification identified (5D992)
• ✓ License exception applicable (ENC 740.17(b)(1))