That's incorrect and a different issue. I'll address it, too, though. The first are systems made to NSA's Type 1 abd TEMPEST certifications. They have requireme

That's incorrect and a different issue. I'll address it, too, though. The first are systems made to NSA's Type 1 abd TEMPEST certifications. They have requirements for RNG's, assuring implementations, failing safe, side channel mitigation, etc. NSA puts them through rigorous pentesting. If NSA cant hack it, then it gets approved to protect Defense assets. There's strong controls on handling the hardware and key systems. Feel free to try to buy NSA's Inline Media Encryptor or General Dynamics Type 1 encryptors. They'll tell you that you can't buy it. Go try. Ask them for a HAIPE implementation while you're at it. I hope you prove me wrong. Far as export, I looked into that in 2014. I found that only a few things, like mass market and ecommerce, got reclassified. High-assurance systems (EAL6/7) they couldnt hack were still munitions. So were custom crypto and some other things. People got fooled: NSA reclassified just the stuff they'd be able to hack anyway. Big progress but not what people thought. https://www.schneier.com/blog/archives/2014/11/the_return_of_c.html#c6682917 https://www.schneier.com/blog/archives/2014/11/the_return_of... They tried to pull more crap about a year after I wrote that: https://www.computerworld.com/article/2925339/us-proposes-tighter-export-rules-for-computer-security-tools.html https://www.computerworld.com/article/2925339/us-proposes-ti... I don't know what current state of affairs is. I assume they've set it up where they can deny selectively if they feel the need to. So far, most "security" products are too insecure for them to need to do that.