is MD5 a encryption method?

md5 is encryption, so unless you're updating an approved app in which the encryption code was exactly the same, your answer shoud be Yes.

In fact even if you didn't change previously approved code, it might not hurt to answer yes, so you'll be able to refer to that approval--but that's just how I tend to do things.

\- Ray

Does your product contain encryption used for protection of data or information security purposes?

Yes

A copy of the commodity classification ruling (CCATS) confirming classification of the Product under ECCN 5D992, as a mass market encryption item under section 742.15(b)(2) of the Export Administration Regulations OR a copy of the “Notification” described in 742.15(b)(1), must be attached.

Some links that might be useful:

[http://www.bis.doc.gov/licensing/exportingbasics.htm]
[http://www.bis.doc.gov/encryption/guidance.htm]
[http://cfr.vlex.com/vid/742-15-encryption-items-19634432]

The third link above will take you directly to CFR 742.15(b). Scroll down to the following paragraph:

(1) Notification requirement for specified encryption items. You may export or reexport encryption items controlled under ECCNs 5A992, 5D992, or 5E992 and identified in paragraphs (b)(1)(i) or (b)(1)(ii) of this section to most destinations without a license (NLR: No License Required), provided that you have submitted to BIS and to the ENC Encryption Request Coordinator at crypt@bis.doc.gov and enc@nsa.gov , by the time of export, the information described in paragraphs (a) through (e) of Supplement No. 6 to this part.

Hope that's helpful!
\- Ray

Here's another link that might help:

[http://cryptome.info/bis100308.htm]

Scroll about 3/4 down to this topic:

Supplement No. 6 to Part 742--Guidelines for Submitting Review Requests
for Encryption Items

Since MD5 is obsolete and no longer considered secure by the US DHS, I was hoping to find some kind of blanket export approval that you could download. But so far I havn't found anything like that.

\- Ray