Help provided to declare SushiTrain in France

[ffries]

Hello,

I am contacting you about the declaration for a cryptographic product in France, which is requested.

I am interested in the iOS build and I already did a declaration 10 years ago for another product.
From my personal knowledge, the people at cyber.gouv.fr are very kind.

So I can help you with the declaration.

1. First, visit:
   https://cyber.gouv.fr/reglementation/reglementation-identite-confiance-numerique/controles-reglementaires-cryptographie/controle-moyen-de-cryptologie/

2. Then download the form and fill and export as PDF:
   https://s3.eu-west-par.io.cloud.ovh.net/sf-cyber/sf-cyber/documents/crypto_form_fourniture_prestation_annexe2.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=f56b12dc7d9741d6bb98766a26a6adca%2F20260102%2Feu-west-par%2Fs3%2Faws4_request&X-Amz-Date=20260102T155414Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=54447a3013d9bed80985b0d31eed044015b761fd70b3306a9138e4545d5f49f9

3. Then send the PDF document to controle[at]ssi.gouv.fr. You should also provide a small documentation in attachment.

After a while, you will receive an authorization number and you are done.

It is quite easy and straightforward. From memory, the whole process should take around 2/3 weeks with a maximum of 4 months.
You should not worry because the cyber.gouv.fr will probably not bother you as software source code is freely available.

Please get back to me for any question.

Kind regards,
FF

[pixelspark]

Hi @ffries, thank you for offering to help. With your help I would like to give this a go.

Your second link doesn't work but I think you are referring to
crypto_form_fourniture_prestation_annexe2.pdf.

As the form is in French, I made a machine translation in English. Could you please check it for correctness? It would also be helpful if you could add some notes, explaining (what you think) they are looking for.

Do they expect answers in French, or is English accepted? (If French, would you be willing to proofread machine translations?).

Also, the form seems to be for cryptography services - Synctrain is an app (hence a 'product'), not so much a service. Are you sure this form is applicable?

[v3lmx]

Hello @pixelspark, I am also willing to help with this declaration.

After reading the legal texts, it seems Synctrain is susceptible to a declaration as you want to distribute a way for people to make use of means of cryptography.

It falls under a specific category (category 3 of annex 2 of the 2007-663 decree of may 2nd 2007) of a means of cryptography that is :

• available to the general public (in this case available to anyone through the apple store)
• the cryptography means cannot be easily modified by the users
• the product can be used without much support from the entity supplying the product

This means in order to import to France, you have to declare the product to ANSSI (but not ask for authorization).

The form you found is the right one, here it is with some notes :
EN_crypto_form_fourniture_prestation_annexe2_annotated.pdf

I think it's better to submit the form in french, I would be happy to help with the translation for the form and any following discussions you might have with ANSSI.

Let me know if you have any questions :)

[pixelspark]

@v3lmx / @ffries thank you for the assistance. I have the form filled out. Would you be so kind to review it?
crypto_form_fourniture_prestation_annexe2 Filled Anonymized.pdf

[v3lmx]

question: Is there a missing part at the end?

Supplementary services for Syncthing are provided by the Syncthing Foundation, which is registered in Sweden. Syncthing

It ends like this, it seems the end of the sentence is missing.

suggestion: I would clarify towards the beginning that you are not affiliated with Syncthing or the Syncthing foundation, it could be slightly confusing to someone not familiar with the ecosystem that these are different entities.

Other than that the document is very thorough, IMO all the questions are clearly answered. If you want to make a machine translation I'll happily proofread it!

[v3lmx]

Also if I may offer an opinion, I think naming the app Syncthing for iOS might make it look like an official client, it sounds a bit weird to me, especially as there is already the Möbius client that provides Syncthing on iOS.
That's just how I feel about it, I though I would let you know :)

[pixelspark]

OK, here's a French version (mostly machine translated with some manual improvements).

crypto_form_fourniture_prestation_annexe2 Filled Anonymized_Francais.pdf

[v3lmx]

Great, here are some paragraphs I modified to fix translation errors or inaccuracies :

En transit :
• QUIC/TLS 1.2/TLS 1.3 (connexions entre appareils, authentification et chiffrement en
transit). La cryptographie TLS standard est utilisée (par exemple ECDH/ECDSA/RSA/SHA),
voir ici pour l'ensemble des ciphers configurés.

Chiffrement des fichiers au repos (fonctionnalité du protocole syncthing « untrusted device encryption ») :
• Scrypt (dérivation de clé de dossier)
• AES-SIV-256 (chiffrement des noms de fichier). AEAD scheme based on AES-128 (32 byte keys)
• HKDF + SHA256 (dérivation de clé pour chaque fichier)
• XChaCha20-Poly1305 (chiffrement du contenu et des métadonnées des fichiers)

---

Comme expliqué ci-dessus, T-Shape ne fournit pas de service aux utilisateurs pour faciliter le partage de fichiers. Les appareils fonctionnant sous Synctrain ou des
logiciels compatibles Syncthing se connectent directement entre eux ou utilisent des services proposés par des tiers (voir éléments techniques, principalement la Syncthing Foundation). T-Shaped n'est pas associée à la Syncthing Foundation.

---

Au premier démarrage, l'utilisateur se voit proposer l’option d'utiliser les services mentionnés ci-dessus tels que
fournis par la Syncthing Foundation. Alternativement, l'utilisateur peut choisir de ne pas utiliser les
services centralisés ou de configurer les siens.

---

Synctrain peut éventuellement permettre à l’utilisateur d’utiliser des services tiers (comme décrit ci-dessus) s’il le souhaite. Les
services proposés par la Fondation Syncthing sont couramment utilisés. Ces derniers sont
(actuellement) fournis par des centres de données en Europe (Allemagne, France, Finlande
actuellement).

---

Comme discuté, T-Shaped ne fournit pas de service de gestion de certificats ou de clés pour les
utilisateurs. L'application elle-même fournit cependant des certificats/clés, voir ci-dessous pour plus de détails.

[pixelspark]

I have submitted a declaration, now we wait for a reply...

[v3lmx]

Hello @pixelspark, did you ever receive a response from ANSSI?

[pixelspark]

Nope, I sent them another email a few days ago but I am not even sure they read their mailbox (and/or whether I made it past their spam filter). Honestly not very motivating!

[v3lmx]

yeah, although for your usecase you have an obligation of declaration, not authorization, so without response you have the right to deploy your application. Does the Apple App store require a document for publishing the app?

[pixelspark]

Yeah, maybe. But at this point I am not even sure my declaration has reached them.

[v3lmx]

I understand, thank you @pixelspark for spending the time to try anyways! If you ever need any more help with this issue feel free to tag me.

[Elaws]

Hi @v3lmx and @pixelspark :

I'm delighted to see some progress has been made. It's been years French users are waiting for this !

Some information that may help :

• ANSSI website has links to many social networks : Github, X, Bluesky, LinkedIn (see at the bottom of this website : https://cyber.gouv.fr/) : Maybe it would be worth contacting them there too ? I have not found a phone number, but I'm eager to help and call them if needed.

• The developper of an app similar to yours, Synctrain, is willing to get help from French users to publish his app on the Appstore (it's already a few years old, so not sure if it still applies) : https://t-shaped.nl/synctrain-support :

If you are a native speaker and resident of a country where the app is not available and you know how to help us navigate the regulatory requirements, feel free to get in touch, help is appreciated.

Maybe it's worth contacting them @v3lmx and provide the help you provided here ?

EDIT : I'm realizing that @pixelspark you are also the developper of Synctrain ? What is the difference between Synctrain and Sushitrain ?

• There's another app called MöbiusSync, but many people have proposed their help to the developper, unfortunately no answer to this day (Not Available in French App Store MobiusSync/MobiusSync#27).

• Finally, I would like to ask, apart from Synctrain, SushiTrain and MöbiusSync, have you heard of other apps doing a similar thing ?

Many thanks, and looking forward to hearing some news !!

[pixelspark]

Sushitrain == Synctrain. I wanted to use the name Sushitrain but it was taken on the App Store. Today I use Sushitrain to refer to the open source project, and Synctrain for the published app.

As for ANSSI, i can try to CC my e-mail to opensource@ssi.gouv.fr.

[Elaws]

Thanks for your reply, yes it's a good idea.

@ffries : Do you have an idea why ANSSI is taking so long to reply ? You said a few weeks to 4 months, and we're already nearing the end of that range.

[pixelspark]

I just received a reply from ANSSI indicating that according to the relevant law I am free to continue the operation convered by the declaration, when ANSSI does not reply within (at most) two months from receiving the declaration. That term has now expired! Now, to convince Apple...

[Elaws]

Great news @pixelspark ! Looking forward to hearing some good news, now that nothing seems to legally prevent you from releasing to FR app store.

[pixelspark]

Right now we're waiting for Apple to approve my declaration form (I just uploaed it). If all is good I receive a key that need to put in the metadata for future releases. I assume I need to release a new version because of this, which could take a while due to app review as well as my own availability the coming weeks. There is a small chance I can also simply check the 'France' box for the current version however.

[pixelspark]

Apple has now approved the declaration form. I have uploaded an iOS TestFlight build (v.25 build 70) with the metadata included. Depending on the feedback from testers, plan to submit this version for release by May 1. This means the app should be available in the French App Store by the start of May!

[v3lmx]

great news! thanks for the efforts on this!

[Elaws]

That's unbelievable, thank you so much for your efforts on this.

After so many years, French users will finally be able to benefit from a syncing solution on their device.