Android app cryptography does it fall under US Export laws?
<p>Basically, I want to encrypt some strings in my app, strings like access tokens or passwords. I planned on using AES, and mainly saw a good library at <a href="https://github.com/tozny/java-aes-crypto" rel="nofollow noreferrer">https://github.com/tozny/java-aes-crypto</a>. Note that this is used only for protection of sensitive data while the app's purpose is other. As I said, simply add a bit of extra security to saved tokens if a root-ed user gains access to the database which stores these values.</p>

<p>However, after reading a bit about cryptography it seems that there are some US Export laws to consider for apps published on Google Play and available to other countries outside US.</p>

<p>Does using AES library in the link above fall under the requirements of US Export laws or because it uses the integrated android libraries and not uses own cryptography library is fine? Or maybe using xor would be better?</p>

<p>Thank you.</p>

<blockquote>
  <p>Does using AES library in the link above fall under the requirements of US Export laws or because it uses the integrated android libraries and not uses own cryptography library is fine?</p>
</blockquote>

<p>If it doesn't have a cryptography engine inside it, you're fine. Even if you wanted to include a cryptography engine, the requirements for exporting cryptography from the U.S. are not difficult to meet at all.</p>

<blockquote>
  <p>As I said, simply add a bit of extra security to saved tokens if a root-ed user gains access to the database which stores these values.</p>
</blockquote>

<p>But how do you select the encryption key? If it's hardcoded into your program then that doesn't really add any security.</p>

cryptography