Yeah, it seems like the U.S. 2nd federal circuit ruled in 2001 in Universal City Studios v. Corley that the DeCSS algorithm itself could not be "trafficked in" without running afoul of the DMCA's anti-trafficking measures. Not just the DVD private keys. (Which I guess DeCSS doesn't strictly need in order to remove DVD DRM? I'm not sure I fully understand exactly how DeCSS works. But anyway.)