5.A.2.Hệ thống, thiết bị và linh kiện, bộ phận "an ninh thông tin", như sau:

N.B. For "satellite navigation system" receiving equipment containing or employing decryption, see 7.A.5.
a. Designed or modified to use 'cryptography for data confidentiality' having a 'described security algorithm', as follows:
1. Items having "information security" as a primary function;
2. Digital communication or networking systems, equipment or components, not specified in 5.A.2.a.1.;
3. Computers, other items having information storage or processing as a primary function, and components therefor, not specified in 5.A.2.a.1. or 5.A.2.a.2.;
N.B. For operating systems, see also 5.D.2.a.1. and 5.D.2.c.1.
4. Items, not specified in 5.A.2.a.1. to 5.A.2.a.3., where the 'cryptography for data confidentiality' having a 'described security algorithm' meets all of the following:
a. It supports a non-primary function of the item; and
b. It is performed by incorporated equipment or "software" that would, as a standalone item, be specified in Category 5 – Part 2.
Technical Notes
1. For the purposes of 5.A.2.a., 'cryptography for data confidentiality' means "cryptography" that employs digital techniques for a cryptographic function or capability that is usable or can be made usable, other than any of the following:
a. "Authentication";
b. Digital signature;
c. Data integrity;
d. Non-repudiation;
e. Digital rights management, including the execution of copy-protected "software";
f. Encryption or decryption in support of entertainment, mass commercial broadcasts or medical records management;
g. Wireless "personal area network" functionality implementing only published or commercial cryptographic standards;
h. Cryptographic operations specially designed for and limited to banking use or money transactions, including the collection and settlement of fares or credit functions;
i. Key management in support of and limited to functions and capabilities described in paragraph a. to h. above; or
j. Cryptographic functions or capabilities that have not been activated or enabled, and can only be activated or enabled by means of secure "cryptographic activation".
N.B. For 'cryptographic activation token' items, see 5.A.2.b., 5.D.2.b. and 5.E.2.b.
2. For the purposes of 5.A.2.a., 'described security algorithm' means any of the following:
a. A 'symmetric algorithm' employing a key length in excess of 56 bits, not including parity bits;
Technical Notes
For the purposes of 5.A.2.a. Technical Note 2.a.:
1. 'Symmetric algorithm' is a cryptographic algorithm using an identical key for both encryption and decryption.
2. A common use of 'symmetric algorithms' is confidentiality of data.
b. An "asymmetric algorithm" where the security of the algorithm is based on any of the following:
1. Factorisation of integers in excess of 512 bits (e.g., RSA);
2. Computation of discrete logarithms in a multiplicative group of a finite field of size greater than 512 bits (e.g., Diffie-Hellman over Z/pZ); or
3. Discrete logarithms in a group other than mentioned in paragraph b.2. in excess of 112 bits (e.g., Diffie-Hellman over an elliptic curve); or
c. An "asymmetric algorithm" where the security of the algorithm is based on any of the following:
1. Shortest vector or closest vector problems associated with lattices (e.g., NewHope, Frodo, NTRUEncrypt, Kyber, Titanium);
2. Finding isogenies between Supersingular elliptic curves (e.g., Supersingular Isogeny Key Encapsulation); or
3. Decoding random codes (e.g., McEliece, Niederreiter).
Technical Note
An algorithm described by Technical Note 2.c. may be referred to as being post-quantum, quantum-safe or quantum-resistant.
Note 1 When necessary as determined by the appropriate authority in the exporter's country, details of items must be accessible and provided to the authority upon request, in order to establish any of the following:
a. Whether the item meets the criteria of 5.A.2.a.1. to a.4.; or
b. Whether the 'cryptography for data confidentiality' having a 'described security algorithm' is usable without secure "cryptographic activation".
Note 2 5.A.2.a. does not apply to any of the following items, or specially designed "information security" components therefor:
a. Smart cards and smart card 'readers/writers' as follows:
1. A smart card or an electronically readable personal document (e.g., token coin, e-passport) that meets any of the following:
a. The 'cryptography for data confidentiality' having a 'described security algorithm' meets all of the following:
1. It is restricted for use in equipment or systems to which 5.A.2.a. does not apply for reasons other than the Cryptography Note (Note 3 in Category 5 – Part 2); and
2. It cannot be reprogrammed for any other use; or
b. Having all of the following:
Note 2 cont.
1. It is specially designed and limited to allow protection of 'personal data' stored within;
2. Has been, or can only be, personalized for public or commercial transactions or individual identification; and
3. Where the 'cryptography for data confidentiality' having a 'described security algorithm' is not user-accessible;
Technical Note
For the purposes of 5.A.2.a. Note 2.a.1.b.1., 'personal data' includes any data specific to a particular person or entity, such as the amount of money stored and data necessary for "authentication".
2. 'Readers/writers';
Technical Note
For the purposes of 5.A.2.a. Note 2.a.2., 'readers/writers' include equipment that communicates with smart cards or electronically readable documents through a network.
b. Not used since 2023
N.B. For items previously described in this Note 2.b., see paragraph h. of Technical Note 1 to 5.A.2.a.
c. Portable or mobile radiotelephones designed for civil use, other than satellite telephones, that are not capable of any of the following:
1. Transmitting encrypted data directly to another radiotelephone or equipment (other than Radio Access Network (RAN) equipment); or
2. Passing encrypted data through RAN equipment (e.g., Radio Network Controller (RNC) or Base Station Controller (BSC));
d. Cordless telephone equipment not capable of end-to-end encryption where the maximum effective range of unboosted cordless operation (i.e., a single, unrelayed hop between terminal and home base station) is less than 400 metres according to the manufacturer's specifications;
e. Portable or mobile radiotelephones and similar client wireless devices, designed for civil use, that have been customised for a specific civil industry application, meeting all of the following:
1. The non-customised devices satisfy the provisions of the Cryptography Note (Note 3 in Category 5 – Part 2); and
2. The 'cryptography for data confidentiality' having a 'described security algorithm' of the non-customised devices is not affected by the customisation, and implements only published or commercial cryptographic standards;
f. Not used since 2023
N.B. For items previously described in this Note 2.f., see paragraph g. of Technical Note 1 to 5.A.2.a.
Note 2 cont.
g. Mobile telecommunications Radio Access Network (RAN) equipment designed for civil use, which also meet the provisions of paragraphs a.2. to a.4. of the Cryptography Note (Note 3 in Category 5 – Part 2), having a Radio Frequency (RF) output power limited to 0.1W (20 dBm) or less, and supporting 32 or fewer concurrent users;
h. Routers, switches, gateways or relays, where the 'cryptography for data confidentiality' having a 'described security algorithm' is limited to the tasks of "Operations, Administration or Maintenance" ("OAM") implementing only published or commercial cryptographic standards;
i. General purpose computing equipment or servers, where the 'cryptography for data confidentiality' having a 'described security algorithm' meets all of the following:
1. Implements only published or commercial cryptographic standards; and
2. Is any of the following:
a. Integral to a Central Processing Unit (CPU) that meets the provisions of Note 3 in Category 5 – Part 2;
b. Integral to an operating system to which 5.D.2. does not apply; or
c. Limited to "OAM" of the equipment; or
j. Items specially designed for a 'connected civil industry application', meeting all of the following:
1. Being any of the following:
a. A network-capable endpoint device meeting any of the following:
1. The 'cryptography for data confidentiality' having a 'described security algorithm' is limited to securing 'non-arbitrary data' or the tasks of "Operations, Administration or Maintenance" ("OAM"); or
2. The device is limited to a specific 'connected civil industry application'; or
b. Networking equipment meeting all of the following:
1. Being specially designed to communicate with the devices specified in paragraph j.1.a. above; and
2. The 'cryptography for data confidentiality' having a 'described security algorithm' is limited to supporting the 'connected civil industry application' of devices specified in paragraph j.1.a. above, or the tasks of "OAM" of this networking equipment or of other items specified in paragraph j. of this Note; and
j. 2. Where the 'cryptography for data confidentiality' having a 'described security algorithm' implements only published or commercial cryptographic standards, and the cryptographic functionality cannot easily be changed by the user.
Technical Notes
1. For the purposes of 5.A.2.a. Note 2.j., 'connected civil industry application' means a network-connected consumer or civil industry application other than "information security", digital communication, general purpose networking or computing.
2. For the purposes of 5.A.2.a. Note 2.j.1.a.1., 'non-arbitrary data' means sensor or metering data directly related to the stability, performance or physical measurement of a system (e.g., temperature, pressure, flow rate, mass, volume, voltage, physical location etc.), that cannot be changed by the user of the device.
b. Being a 'cryptographic activation token';
Technical Note
For the purposes of 5.A.2.b., a 'cryptographic activation token' is an item designed or modified for any of the following:
1. Converting, by means of "cryptographic activation", an item not specified in Category 5 – Part 2 into an item specified in 5.A.2.a. or 5.D.2.c.1., and not released by the Cryptography Note (Note 3 in Category 5 – Part 2); or
2. Enabling, by means of "cryptographic activation", additional functionality specified in 5.A.2.a. of an item already specified in Category 5 – Part 2.
c. Designed or modified to use or perform "quantum cryptography";
Technical Note
For the purposes of 5.A.2.c., "quantum cryptography" is also known as Quantum Key Distribution (QKD).
d. Designed or modified to use cryptographic techniques to generate channelising codes, scrambling codes or network identification codes, for systems using ultra-wideband modulation techniques and having any of the following:
1. A bandwidth exceeding 500 MHz; or
2. A "fractional bandwidth" of 20% or more;
e. Designed or modified to use cryptographic techniques to generate the spreading code for "spread spectrum" systems, not specified in 5.A.2.d., including the hopping code for "frequency hopping" systems.
NON-CRYPTOGRAPHIC "INFORMATION SECURITY"