Review IS required for encryption commodities and software that:

a. Are “mass market” products with symmetric key length exceeding 64-bit algorithms
 . . .
b. Do not qualify as “mass market” and employ key lengths greater than 56-bits for symmetric algorithms, 512-bits for asymmetric algorithms and 112-bits for elliptic curve algorithms (“checklist” questions 2.a and 2.b), or which provide an open cryptographic interface as defined in Section 772.1.

Current guidelines on what kind of encryption technology requires review before export from the U.S.