Commercial National Security Algorithm Suite

The Commercial National Security Algorithm Suite (CNSA) is a set of cryptographic algorithms promulgated by the National Security Agency as a replacement for NSA Suite B Cryptography algorithms. It serves as the cryptographic base to protect US National Security Systems information up to the TOP SECRET level. Two versions of CNSA exist: the pre-quantum 1.0 of 2015 and the quantum-resistant 2.0 of 2022.^{[1][2][3][4][5][6]}

Timeline for the transition to CNSA 2.0

Contents

CNSA 1.0

A singular parameter length is provided for protection up to TOP SECRET level.

Components of CNSA 1.0

Purpose	Algorithm	Standard	Parameter Length	Bits of Security	Notes
Symmetric encryption	AES	FIPS 197	256	256
Digital Signature	Elliptic Curve Digital Signature Algorithm (ECDSA)	FIPS 186-4	384	192	Use curve P-384 only.
	RSA	FIPS 186-4	3072	128	Minimum modulus size, can be larger.
Key agreement	Elliptic-curve Diffie–Hellman (ECDH)	NIST SP 800-56Ar3	384	192	Use curve P-384 only.
	Diffie–Hellman key exchange	RFC 3526	3072	128	Minimum modulus size, can be larger.
	RSA	FIPS SP 800-56Br2	3072	128	Minimum modulus size, can be larger.
Message digest	SHA-2	FIPS 180-4	384	192	Use exactly SHA-384.

The CNSA 1.0 transition is notable for moving RSA from a temporary legacy status, as it appeared in Suite B, to supported status. It also did not include the Digital Signature Algorithm. This, and the overall delivery and timing of the announcement, in the absence of post-quantum standards, raised considerable speculation about whether NSA had found weaknesses e.g. in elliptic-curve algorithms or others, or was trying to distance itself from an exclusive focus on ECC for non-technical reasons.^[7][8][9]

Documents describing the integration of CNSA 1.0 with Internet protocols include:

• RFC 9151 Commercial National Security Algorithm (CNSA) Suite Profile for TLS and DTLS 1.2 and 1.3
• RFC 9206 Commercial National Security Algorithm (CNSA) Suite Cryptography for Internet Protocol
• RFC 9212 Commercial National Security Algorithm (CNSA) Suite Cryptography for Secure Shell (SSH)
• RFC 8755 Using Commercial National Security Algorithm Suite Algorithms in Secure/Multipurpose
• RFC 8756 Commercial National Security Algorithm (CNSA) Suite Profile of Certificate Management over CMS
• RFC 8603 Commercial National Security Algorithm (CNSA) Suite Certificate and Certificate Revocation List (CRL) Profile

CNSA 2.0

In September 2022, the NSA announced CNSA 2.0, which includes its first recommendations for post-quantum cryptographic algorithms. Again, all parameters are provided for TOP SECRET level.^[10]

Components of CNSA 2.0^[11]

Purpose	Algorithm	Standard	Parameter Length	Bits of Security	Notes
Symmetric encryption	AES	FIPS 197-upd1	256	256
Key agreement	ML-KEM	FIPS 203	ML-KEM-1024	256
Digital signature	ML-DSA	FIPS 204	ML-DSA-87	256
Message digest of data	SHA-2	FIPS 180-4	384 or 512	192 or 256
Digital signature of firmware and software	Leighton-Micali	NIST SP 800-208	192 or 256	192 or 256	All standard parameter sets are approved, the minimum being SHA256/192. SHA256/192 is the recommended choice.
	Xtended Merkle	NIST SP 800-208	192 or 256	192 or 256	All standard parameter sets are approved, the minimum being SHA256/192.
Message digest for hardware integrity checks
	SHA-3	FIPS 202	384 or 512	192 or 256	Allowed for internal hardware functionality only (e.g., boot-up integrity checks)

Note that compared to CNSA 1.0, CNSA 2.0:

• Suggests separate post-quantum algorithms (XMSS/LMS) for software/firmware signing for use immediately
• Allows SHA-512
• Announced the selection of CRYSTALS-Kyber and CRYSTALS-Dilithium early, with the expectation that they will be mandated only when the final standards and FIPS-validated implementations are released. RSA, Diffie-Hellman, and elliptic curve cryptography will be deprecated at that time.

Documents describing the integration of CNSA 2.0 with Internet protocols include:

• draft-becker-cnsa2-smime-profile-01 Commercial National Security Algorithm (CNSA) Suite Profile for Secure/Multipurpose Internet Mail Extensions (S/MIME)
• draft-becker-cnsa2-ssh-profile-02 Commercial National Security Algorithm (CNSA) Suite Profile for SSH
• draft-becker-cnsa2-tls-profile-02 Commercial National Security Algorithm (CNSA) Suite Profile for TLS 1.3
• draft-guthrie-cnsa2-ipsec-profile-01 Commercial National Security Algorithm (CNSA) Suite 2.0 Profile for IPsec
• draft-jenkins-cnsa2-cmc-profile-01 Commercial National Security Algorithm (CNSA) Suite Profile of Certificate Management over CMS
• draft-jenkins-cnsa2-pkix-profile-03 Commercial National Security Algorithm Suite Certificate and Certificate Revocation List Profile