Recently, we have been hearing a lot about the (National Security Agency) NSA’s new (Commercial National Security Algorithm) CNSA Suite 2.0. The document was released in September of 2022 and can be found here. Likely, you have been hearing about it as well so we thought it might be a good idea to point out some interesting details.
The document focuses on notifying parties involved in National Security Systems (NSS) – such as vendors like you – that new requirements are coming. These requirements mandate a shift to quantum-resistant (also known as post-quantum) algorithms and the deprecation of legacy algorithms (ie RSA, DH, ECC). What does this mean for you?
It means that if you are making niche equipment for the NSS, you will need to switch to supporting post-quantum algorithms by 2030 and then only supporting them exclusively by 2033. The CNSA Suite 2.0 does allow for usage of legacy algorithms as a component of a hybrid solution, but their use alone will become unapproved. This is a very big change and wolfSSL is here to support you through this transition.
The document mentions the following algorithms; we have added our current support status for these algorithms beside each one:
- AES-256 – (Supported. Have our own implementation.)
- SHA-384 – (Supported. Have our own implementation.)
- SHA-512 – (Supported. Have our own implementation.)
- CRYSTALS-Kyber Level 5 – (Supported via integration with liboqs, PQM4 AND currently working on our own implementation.)
- CRYSTALS-Dithium Level 5 – (Supported via integration with liboqs.)
- LMS all variants – (Not supported yet.)
- XMSS all variants – (Not supported yet.)
It is important to note that the transition dates mentioned above are for vendors that deal with the US government. Are you further down the supply chain? If so, then your customers need you to be ready even earlier as they will need time to develop their solutions. Don’t get caught unprepared!
Want to learn more about post-quantum cryptography? Want to try experimenting with these algorithms in TLS, SSH or MQTT? Looking to better understand our plans around LMS and XMSS? Please contact your regional business director or send your inquiries to support@wolfssl.com to start a conversation with our expert engineers.