What is an ECCN?
The five character alpha-numeric ECCN identifies the technology level and the capabilities of an item which, in combination with the country of destination, customer, and the intended application, determine if an export license is required for a specific transaction or whether an item can be exported without a license. The ECCN must be determined prior to shipment.
mbed TLS's ECCN number
mbed TLS has a US export control classification of ECCN 5D002:
Per the note in US EAR 734.3(b)(3)
Publicly available encryption object code "software" classified under ECCN 5D002 is not subject to the EAR when the corresponding source code meets the criteria specified in 742.15(b) of the EAR.
US EAR 742.15(b)
b) Publicly available encryption source code—(1) Scope and eligibility. Subject to the notification requirements of paragraph (b)(2) of this section, publicly available (see §734.3(b)(3) of the EAR) encryption source code classified under ECCN 5D002 is not subject to the EAR. Such source code is publicly available even if it is subject to an express agreement for the payment of a licensing fee or royalty for commercial production or sale of any product developed using the source code.
The crypto source code for MBED TLS is available in open source, so per above software classified 5D002 is not subject to the U.S Export Administration Regulations (“EAR”).
For additional information about the EAR or LICENSEE’s obligations under those regulations, please refer to the U.S. Bureau of Industry and Security’s website.
Under the EU and UK export regulations, mbed TLS is not controlled as it falls under the open source rules.