OpenDrop - App Store Export Compliance Documentation

Encryption Overview

Summary of Encryption Usage

What OpenDrop Does NOT Use

• Proprietary encryption algorithms
• Custom cryptographic implementations
• Modified versions of standard algorithms
• Encryption not accepted by international standards bodies
• Government-specific encryption features

Mobile App Encryption

Platform: iOS & Android (Flutter/Dart)

1. Firebase Authentication

Library: firebase_auth (Flutter)
Purpose: User authentication and session management
Encryption: TLS 1.2/1.3 (platform-provided)
Standards: OAuth 2.0 (RFC 6749), JWT (RFC 7519)

Usage in Code:

• auth_service.dart: Firebase Auth for user sign-in
• ID token generation and refresh
• Cross-platform user identification

2. Google Sign-In

Library: google_sign_in (Flutter)
Purpose: OAuth 2.0 authentication with Google
Encryption: TLS via platform SDK
Standards: OAuth 2.0 (RFC 6749, RFC 6750)

Usage in Code:

• auth_service.dart: GoogleSignIn class for OAuth flow
• Credential exchange with Firebase

3. RevenueCat (In-App Purchases)

Library: purchases_flutter
Purpose: Subscription management and purchase verification
Encryption: TLS 1.2/1.3 (SDK-provided)
Standards: HTTPS, platform billing APIs

Usage in Code:

• subscription_service.dart: Subscription status checking
• main.dart: SDK initialization
• config.dart: API key configuration

4. HTTP Communication (Dio)

Library: dio (Dart)
Purpose: API calls to OpenDrop desktop server
Encryption: TLS via platform SSL/TLS stack
Standards: HTTPS (RFC 2818)

Usage in Code:

• api_service.dart: All server communication
• file_uploader.dart: Chunked file uploads
• Session token and API key transmission

5. QR Code Scanning

Library: mobile_scanner
Purpose: Scan QR codes for connection setup
Encryption: None (camera input only)

Note: QR scanning itself does not use encryption. The scanned data (connection URL and secret) is transmitted over HTTPS.

6. End-to-End File Encryption

Library: cryptography / cryptography_flutter (Apple CryptoKit on iOS, Android BoringSSL), PointyCastle fallback
Purpose: End-to-end encryption of file contents on every transfer path (LAN, peer-to-peer, relay, BLE)
Encryption: ChaCha20-Poly1305 IETF AEAD (256-bit key); HKDF-SHA256 key derivation; HMAC-SHA256 request signing
Standards: ChaCha20-Poly1305 (RFC 8439), HKDF (RFC 5869), HMAC (RFC 2104)

Usage in Code:

• crypto_utils.dart, e2ee_wire.dart: AEAD encrypt/decrypt, content-key derivation, request signing
• Applied to all uploads, downloads, thumbnails, and nearby transfers — there is no plaintext fallback

Mobile Encryption Summary Table

Desktop Server Encryption

Platform: Python (Windows, macOS, Linux)

1. HTTPS Communication

Library: requests (Python)
Purpose: Sync data to Cloudflare Worker
Encryption: TLS 1.2/1.3 via OS SSL stack
Standards: HTTPS (RFC 2818)

Usage in Code:

• cloud_sync.py: sync_to_cloud(), _heartbeat_loop()

2. OAuth 2.0 Authentication

Library: google-auth-oauthlib
Purpose: Google Sign-In for desktop
Encryption: TLS via requests library
Standards: OAuth 2.0 (RFC 6749, RFC 6750)

Usage in Code:

• auth.py: Credential management and token refresh

3. OpenDrop WebSocket Relay

Component: Self-hosted WebSocket relay (Fly.io primary for Pro, Oracle Cloud for free tier and Pro failover)
Purpose: Forwards end-to-end-encrypted bytes between devices on different networks
Encryption: WebSocket over TLS 1.2/1.3 (transport); ChaCha20-Poly1305 IETF AEAD (payload, E2EE)
Standards: WebSocket (RFC 6455), TLS 1.2/1.3 (RFC 8446), ChaCha20-Poly1305 (RFC 8439)

Usage in Code:

• relay_client.py: outbound WebSocket relay session (replaced the former tunnel.py cloudflared transport), with automatic Fly.io→Oracle Cloud failover

4. End-to-End File Encryption

Library: cryptography (pyca / OpenSSL backend)
Purpose: End-to-end encryption of file contents on every transfer path (LAN, peer-to-peer, relay)
Encryption: ChaCha20-Poly1305 IETF AEAD (256-bit key); HKDF-SHA256 key derivation; PBKDF2-HMAC-SHA256 account-secret derivation; HMAC-SHA256 request signing
Standards: ChaCha20-Poly1305 (RFC 8439), HKDF (RFC 5869), PBKDF2 (RFC 2898), HMAC (RFC 2104)

Usage in Code:

• crypto/aead.py, crypto/wire.py: AEAD encrypt/decrypt and framed streaming
• server/validation.py: HMAC-SHA256 request signing (5-minute timestamp window)

5. Session Management

Implementation: Server-generated tokens
Purpose: Authenticated session continuity
Transmission: HTTPS headers

Usage in Code:

• middleware.py: Session validation
• health.py: Session creation

Server Encryption Summary Table

Third-Party SDKs

SDK Encryption Attestations

All third-party SDKs use standard encryption provided by their respective platforms and comply with international encryption standards.

Export Compliance Questionnaire

U.S. Export Administration Regulations (EAR) Responses

Q1: Does your app use encryption?

Yes

Q2: Does your app qualify for any exemptions provided in Category 5, Part 2 of the EAR?

Yes - Mass market exemption under EAR 740.17(b)(1)

Q3: Does your app implement any proprietary or non-standard cryptographic algorithms?

No - All encryption uses industry-standard algorithms: ChaCha20-Poly1305 (RFC 8439), HKDF-SHA256 (RFC 5869), HMAC-SHA256 (RFC 2104), PBKDF2-HMAC-SHA256 (RFC 2898), RSA-2048/SHA-256, and TLS 1.2/1.3

Q4: Does your app only use encryption provided by the operating system?

No - The app uses additional standard third-party libraries, but all implement standard algorithms

Q5: Is your app available without restriction?

Yes - Available to general public

Q6: Is the encryption user-configurable?

No - Users cannot modify encryption settings

Q7: Is your app designed for government use?

No - Consumer file sharing application

Exemption Qualification

App Store Connect Submission Guide

Step-by-Step Answers

When submitting your app to App Store Connect, you will be asked about export compliance. Use these answers:

Screen 1: Export Compliance

"Does your app use encryption?"

Select: Yes

Screen 2: Exemption Qualification

"Does your app qualify for any of the exemptions provided in Category 5, Part 2 of the U.S. Export Administration Regulations?"

Select: Yes

Screen 3: Encryption Type

"Does your app contain, use, or access third-party encryption?"

Select: Yes

"Does your app implement or use cryptography that is proprietary or not accepted as standard by international standard bodies (IEEE, IETF, ITU, etc.)?"

Select: No

Screen 4: Distribution

"Is your app going to be available on the French App Store?"

Select: Yes (app qualifies for all territories)

Annual Self-Classification Report

If required, use BIS classification:

• ECCN: 5D992
• License Exception: ENC (740.17(b)(1))

Declaration Statement

For Apple App Store Review

OpenDrop version 1.0.0 uses encryption exclusively for:

1. End-to-end encryption of file contents via ChaCha20-Poly1305 IETF AEAD (RFC 8439) with HKDF-SHA256-derived keys (RFC 5869)
2. Secure network communication via HTTPS using standard TLS 1.2/1.3 protocols
3. User authentication via OAuth 2.0 (Google Sign-In) and Firebase Authentication
4. In-app purchase verification via RevenueCat SDK using platform billing APIs
5. Secure transport via WebSocket over standard TLS to our own relay infrastructure
6. Request authentication via HMAC-SHA256 signing (RFC 2104)
7. JWT token handling for session management using standard RFC 7519 format

No proprietary encryption algorithms are implemented. All cryptographic functionality is provided by:

• Standard open-source crypto libraries (pyca/cryptography with OpenSSL, Apple CryptoKit, Android BoringSSL, PointyCastle)
• Apple's Security framework and App Transport Security
• Firebase SDK (Google)
• RevenueCat SDK
• Platform-provided TLS/SSL implementations

This application qualifies for the mass market encryption exemption under U.S. Export Administration Regulations section 740.17(b)(1).

For Google Play Console

OpenDrop uses encryption for secure data transmission only. All encryption is provided by:

• Android platform TLS/SSL
• Firebase Authentication SDK
• RevenueCat Purchases SDK
• Standard HTTPS for API communication

No custom or proprietary encryption algorithms are used.

Technical Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│                        OPENDROP SYSTEM                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌─────────────────┐         HTTPS/TLS          ┌────────────┐  │
│  │   Mobile App    │◄──────────────────────────►│  Firebase  │  │
│  │   (Flutter)     │         OAuth 2.0          │   Auth     │  │
│  └────────┬────────┘                            └────────────┘  │
│           │                                                     │
│           │ HTTPS/TLS                                           │
│           │                                                     │
│           ▼                                                     │
│  ┌─────────────────┐         HTTPS/TLS          ┌────────────┐  │
│  │   RevenueCat    │◄──────────────────────────►│   Store    │  │
│  │      SDK        │                            │   APIs     │  │
│  └─────────────────┘                            └────────────┘  │
│                                                                 │
│  ┌─────────────────┐    WebSocket over TLS      ┌────────────┐  │
│  │  Desktop Server │◄──────────────────────────►│  OpenDrop  │  │
│  │    (Python)     │       (relay, E2EE)        │   Relay    │  │
│  └────────┬────────┘                            └────────────┘  │
│           │                                                     │
│           │ HTTPS/TLS                                           │
│           ▼                                                     │
│  ┌─────────────────┐                            ┌────────────┐  │
│  │   Cloudflare    │◄──────────────────────────►│   Mobile   │  │
│  │     Worker      │         HTTPS/TLS          │    App     │  │
│  └─────────────────┘                            └────────────┘  │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────┐    │
│  │                  ENCRYPTION STANDARDS                   │    │
│  │  • ChaCha20-Poly1305 E2EE (IETF RFC 8439)               │    │
│  │  • HKDF-SHA256 (IETF RFC 5869)                          │    │
│  │  • HMAC-SHA256 (IETF RFC 2104)                          │    │
│  │  • TLS 1.2/1.3 (IETF RFC 8446)                          │    │
│  │  • OAuth 2.0 (IETF RFC 6749)                            │    │
│  │  • JWT (IETF RFC 7519)                                  │    │
│  │  • HTTPS (IETF RFC 2818)                                │    │
│  │  • WebSocket (RFC 6455)                                 │    │
│  └─────────────────────────────────────────────────────────┘    │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

All connections use standard encryption - NO proprietary algorithms

Appendix A: Code File Encryption Reference

Mobile App Files

Desktop Server Files

Appendix B: Compliance Checklist

Before submission, verify:

• ✓ All encryption uses standard algorithms (TLS, OAuth, JWT)
• ✓ No proprietary encryption implemented
• ✓ Third-party SDKs use standard encryption
• ✓ App is available to general public
• ✓ No government-specific features
• ✓ Users cannot modify encryption settings
• ✓ Documentation prepared for App Store Review
• ✓ ECCN classification identified (5D992)
• ✓ License exception applicable (ENC 740.17(b)(1))