Notification validity term

From IFCG Encyclopedia

Notification is a legal document providing with information on the cryptographic algorithms used in a product, which should be registered in the FSB of Russia (or in a respective approving authority of the EAEU member state). This document confirms that a device with cryptographic functions may be imported to the EAEU territory or exported from it.

Indication of the notification validity period

The end date of validity is provided in the notification in the form of DD.MM.YYYY. The only requirement to this date is that the manufacturer undertakes to keep cryptographic functions of the product (model) unchanged until the stated date. There are no other limitations for minimum or maximum period of notification validity prescribed by the law.

In practice, this date is usually taken reasonably far in the future, with due consideration of prospects for distribution of products (e.g., +5 or +10 years from the present time).

Reference to a registered notification

Sometimes a complex product may include a component (an electronic chip, an operating system, etc.) which has a registered notification already. In this case the newly issued notification should contain a reference to the existing notification, and obviously its validity period may not exceed that of the component's notification.

For example, for devices such as laptops or tables, coming with Windows 10 operating system, the end date of validity of the notification can not be later than 01.01.2025, as a period of validity of the registered notification for OS Windows 10 ends on 01.01.2025 (RU0000021617).

The end date of validity of a registered notification may be checked on the EAEU’s web site.

Changes in cryptographic functions of a product

If a cryptographic function of a product changes (without changing its model or other information provided in the notification) before the end date of the notification validity, importation of products based on such notification becomes illegal. As the law does not imply amendments to the registered notifications, the manufacturer should do the following to resolve this issue:

  • send a request to cancel existing notification to the approving authority of the EAEU member state in which the notification was originally registered;
  • issue a new notification with due account for all changes in the product and apply for registration (in any EAEU member state).

See also