Cisco Cryptographic Help

END-USER SECTOR

OTHER LINKS

SPECIAL NOTES

Import & Use
Legal Disclaimer
Order Guidance

Cryptographic Troubleshooting FAQ

General Information Regarding Cryptographic Software
Cisco is making changes to the existing cryptographic software distribution policy to streamline delivery of software to customers and help automate the download process. We are also being good corporate citizens by continuously adjusting our policy to comply with changes to U.S. Government export regulations. Listed below are common questions and answers regarding this policy. If you are a Cisco employee there is additional information available.

Q: What Is Software Entitlement?
A: Software Entitlement is the process of logging a user's name and relevant information, and their agreement to follow export control laws so that they can download cryptographic software. Export laws and regulations require Cisco to screen customers to determine if they are eligible to download cryptographic images.
Q: How do I download Strong Cryptographic Images?
A: Strong cryptographic software must be downloaded through the Software Center downloads area on the Cisco Software Center (requires Cisco.com account), or via the Special File Access tool. The Special File Access tool would typically be used when a TAC engineer publishes a special software image for a customer, which isn't available on Software Center. Strong cryptographic images are no longer being stored on the Cisco FTP server.
Q: How do I get approval for Strong Cryptographic Images?
A: Customers can gain access by completing the Encryption Form when prompted during the download process. The user will be prompted to complete the Encryption Entitlement Form the first time they select a strong cryptographic image in the Cisco Software Center and every time they download an image for someone other than themselves. The ability to download cryptographic images is wholly dependent on this form and cannot be accomplished without completing it. For more information on encryption control regulations, please see Encryption Control Guidance page.
Q: Who is prohibited from Accessing Cryptographic Images?
A: The current list of prohibited countries, entities, and denied persons is available in General Advisories.
Q: What is the definition of strong Cryptographic Software?
A: Strong Cryptographic is defined today as greater than 64 bit DES strength or the equivalent. For more information you should consult the Cisco Encryption Sales Tool Quick Reference Guide.
Q: What is the "Deemed Export" rule and is there any additional information on exporting software technology outside the USA?
A: The Department of Industry and Security provides an FAQ with common questions on answers on exporting technology and software located here "Deemed Export" Questions and Answers
Q: Who do I contact if I still have questions about Cryptographic images?
A: If you still have questions regarding Cryptographic images, please review this information or email export@cisco.com or contact them via telephone or mail at:
Q: Should I update my Cisco.com (formally CCO) profile if I move or change companies?
A: You are encouraged to update your profile with your latest information to prevent interruption to your Cisco.com access. Please go to Profile and verify your information is still correct.
Q: I am downloading Cryptographic software for someone other then myself or my organization, do I still need to complete the forms?
A: Yes, you need to complete Encryption Software Export Distribution form every time you download an image for someone other then yourself or your organization. You must provide a valid Cisco.com user ID, or fill out the end user form for each download. US law requires Cisco Systems, Inc. to report the ultimate end-user of the encryption image download.
Q: I need to download Cryptographic as part of a PSIRT announcement, how do I do this?
A: Typically fixed images will be available on Cisco.com at the time of the announcement and if you have a valid service contract in your profile then you will simply download the image from the Software Download Center. If you do not have download access on Cisco.com then you will need to open a service request with the Cisco TAC to have the image posted for you in the Special File Access area of Cisco.com. Use your PSIRT announcement as proof of entitlement for support.

Help with Cryptographic Software Download Issues
Entitlement issues:

Q: What do I do if I am unable to download software?
A: Verify that you are entitled to download images from Software Center. Check your Profile, but generally you need a Cisco.com account with a valid service contract to download images. If you are not sure if you are entitled to download images contact web-help@cisco.com.
Q: What do I do if I am unable to download cryptographic software?
A: If you are able to download software from Software Center but are unable to download cryptographic software, then you must complete the Encryption Entitlement Form. As of May 8, 2004 you must now complete an Encryption Entitlement Form before you download cryptographic software. The first time after May 8, 2004 you try to download cryptographic software, you will be automatically prompted to complete this form. If you do not successfully complete this form, or fail to meet the criteria specified by export regulations, you will be unable to download cryptographic software from Cisco.com. Also ensure you have only one Cisco.com account.
Q: What do I do if I have just created a Cisco.com profile and cannot download software?
A: If you have just created a CDC account it will be in pending status until it can be approved. In this situation, a user has an ID but is not approved to be interacting in the system and will not be able to download software from the Software Center. In order to download software all users must have a valid service contract attached to their profiles. Contact web-help@cisco.com.
Q: What do I do if I cannot download cryptographic software even though I can download other software?
A: In order to gain access to cryptographic software you must complete the Encryption Entitlement Form. You will be prompted to do this when you select the images you want to download.
If you have done this and still do not have access, contact CA Business Controls contactcabc@cisco.com.
Q: I am having problems with my Cisco.com (Formally CCO) profile, where do I go to get help?
A: To resolve issues with your Cisco.com profile you should contact web-help@cisco.com.
Q: What do I do if I have completed the Encryption Entitlement Form and I am still unable to download cryptographic software?
A: If you have completed this form successfully, or are unable to complete this form then please consult the Cryptographic Software Download Troubleshooting Guide below. If you are internal to Cisco, then please consult this guide. If you have reviewed the Cryptographic Software Download Troubleshooting Guide and still are unable download cryptographic images, then please contact export@cisco.com.

Technical Issues:

Q: A TAC engineer/Cisco employee has published an image for me with the Special File Access tool and I am unable to download it.
A: To use SFA tool you have to use the CDC ID entered by the TAC engineer when the file was uploaded. If the TAC engineer did not use your correct CDC user name, or if you did not give him one that is not entitled to download cryptographic software, then all attempts to download will be rejected.
Other causes of rejection can include:
Q: Can I still download cryptographic images directly from FTP.cisco.com ?
A: No, access to this FTP server has been discontinued. If you need an image that is not on Software Center downloads, then you must open a Service Request and have a TAC engineer post the image for you. Note: You will still be required to complete the Export Entitlement Forms if you have not done so already.
Q: Is it is possible to use the Special File Access code as a password and download files using FTP.cisco.com ?
A: No, access to this FTP server has been discontinued. The only way to download software images is by using the Special File Access tool. FTP cannot be used to gain access to files in the SFA directories.
Q: Can unrecognized characters in Cisco.com (CDC) customer profile cause registration to be rejected?
A: Yes, there is an open issue with certain unrecognized characters in the name and address fields causing problems with processing entitlement to download software. For example, the accent mark in Québec will not work and should be changed to just Quebec, as a work around for this open issue. In another example, the "&" sign in the address below will cause the database to reject the address and should be removed until this issue is resolved
20/F & 21/F
ANYWHERE PLAZA

To access your profile, please select Profile, or go to Cisco.com and select "profile" on the top bar to edit your profile.
Q: What happens if I am unable to download a specific Cryptographic image but can download others?
A: If you are unable to download a specific Cryptographic image but are able to download others, you will need to open a TAC service request so the image can be posted for you.
Q: What happens if I am unable to locate a specific Cryptographic image?
A: If you are unable to locate a specific Cryptographic image, please use the search tool: If you can not locate the image through the search tool, open a TAC service case. Please provide the image name you are trying to download.
Q: What happens if I get an "Internal Server Error"?
A: If you receive this error, contact web-help@cisco.com, please provide the image name you were trying to download.

Additional Information:

Briefly, Cisco has obtained authority to deliver Cisco strong encryption solutions to a wide variety of end-users and destinations without having to apply for individual licenses. Cisco's strong encryption solutions have undergone one-time-review by the U.S. Government and qualify for license exception "ENC" (15 CFR Part 740.17)

COMMERCIAL/ CIVILIAN - STRONG ENCRYPTION
Cisco may deliver Cisco strong encryption solutions to civilian/commercial end-users located in all territories except:
Cuba, Iran, Iraq*, Libya*, North Korea, Sudan, and Syria without obtaining a U.S. export license.
(*Highly Restricted, not embargoed)

GOVERNMENT - STRONG ENCRYPTION - NON-RETAIL
Government entities not on the list below require US export licenses in order to obtain non-retail strong encryption. Customers should contact ECRA at export@cisco.com to initiate a license application.

Austria, Australia, Belgium, Canada, Czech Republic, Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal, Spain, Sweden, Switzerland, United Kingdom, United States

64 BIT OR LESS
64 bit or less may be delivered to government, civilian, military and commercial end users around the world excluding entities or end users in the following countries:
Cuba, Iran, Libya, North Korea, Sudan, and Syria

DENIED/RESTRICTED PARTIES LIST
Cisco solutions may not be delivered to individuals or entities listed on the US Government's Denied/Restricted Parties List without first obtaining a license.

DELIVERY, IMPORT, AND USE
Delivery of Cisco cryptographic products does not imply third-party authority to import, distribute, or use encryption.

•Importers, distributors, customers and users are responsible for compliance with all local country laws.
•Cisco strongly recommends that importers, distributors, and users investigate such regulations prior to encryption product deployment.
•Cisco encourages the customer to contact their local freight forwarder, consultant or an attorney with knowledge of international export requirements.
•Cisco refrains from coaching customers regarding international requirements due to liability issues.

TRADE TOOL - ECCNs, HTS, PRODUCT WEIGHTS
You may locate ECCNs and HTS at the following link - http://tools.cisco.com/FinAdm/GCTA/servlet/
ControllerServlet?action=QueryForm.

If required, you may obtain a guest CCO log in at the following link.
http://tools.cisco.com/RPF/register/register.do

Customers must comply with the conditions defined therein. For additional guidance, please visit the U.S. Bureau of Industry and Security's website on Commercial Encryption Export Controls.

The BIS website provides US Export information - http://www.bis.doc.gov/.