The typical area where this comes up is 17 USC 1201(a)(2); "No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that" [breaks DRM]. "Otherwise traffic" is a big universe of actions, as is "offer to the public."
The courts that handled the DeCSS cases (code that broke DVD encryption) allowed that code like DeCSS was speech protected by the First Amendment, but basically ruled that the functional aspect of the code meant it gets lesser protection. Posting the code, but even just linking to somewhere else it could be found, were both found to violate the DMCA, and that restriction was found to be permitted by the First Amendment.
The courts that handled the DeCSS cases (code that broke DVD encryption) allowed that code like DeCSS was speech protected by the First Amendment, but basically ruled that the functional aspect of the code meant it gets lesser protection. Posting the code, but even just linking to somewhere else it could be found, were both found to violate the DMCA, and that restriction was found to be permitted by the First Amendment.