STDA060 October   2026 MSPM0G3519 , MSPM0G3519-Q1 , MSPM33C321A , MSPM33C321A-Q1

 

  1.   1
  2.   Abstract
  3.   Trademarks
  4. 1 Introduction
  5. 2 Security Goals in Embedded Systems
  6. 3 Cryptographic Primitives
  7. 4 The Potential Effects of CRQCs
  8. 5 New Algorithms and Standards for the Future
  9. 6 CNSA Compliance
  10. 7 Symmetric Encryption and Hash Functions
  11. 8 PQC Digital Signatures: ML-DSA
  12. 9 Is Hardware Acceleration Necessary?
  13. 10Is Pre-Hash Necessary?
  14. 11Other NIST-Selected PQC Digital Signature Schemes
  15. 12Stateful Digital Signature Schemes
  16. 13What About Key Agreement?
  17. 14Future-Proofing Embedded Systems
  18. 15References

6 CNSA Compliance

In the United States, products used in national security systems must comply with the National Security Agency's (NSA) commercial national security algorithm (CNSA) suite. In 2022, the NSA updated the CNSA suite from version 1.0 to version 2.0; one of the primary motivations for CNSA 2.0 was the incorporation of PQC. New deployments of the CNSA suite must comply with version 2.0 by Jan. 1, 2027, while already deployed systems must comply or be replaced with CNSA 2.0-compliant systems by Dec. 31, 2030.

Table 6-1 lists the cryptographic primitives approved for CNSA 1.0 versus the required cryptographic primitives approved for CNSA 2.0.

Table 6-1 Comparing Approved Cryptographic Primitives for CNSA 1.0 and CNSA 2.0
Application usage Cryptographic primitive CNSA 1.0 approved CNSA 2.0 approved [2]
General-purpose cryptography Symmetric encryption

Federal Information Processing Standard (FIPS) publication (PUB) 197

(Advanced Encryption Standard [AES]-256 only)
Secure hash

FIPS PUB 180-4

(secure hash algorithm [SHA]-384 only)

FIPS PUB 180-4

(SHA-384 or SHA-512)
Digital signature

FIPS PUB 186-4

(ECDSA P-384 or Rivest, Shamir and Adleman 3,072-bit modulus)

FIPS PUB 204

(Module Lattice Based-Digital Signature Standard [ML-DSA]-87 only)
Key agreement Elliptic Curve Diffie-Hellman P-384 or Finite Field Diffie-Hellman (3,072-bit modulus)

FIPS PUB 203

(Module Lattice Based-Key-Encapsulation Mechanism [ML-KEM]-1,024 only)
Firmware or software signing only Digital signature –

NIST special publication (SP) 800-208

(Leighton-Micali Signature [LMS] or eXtended Merkle Signature Scheme [XMSS] [1])
Hardware integrity checking only Secure hash –

FIPS PUB 202

(SHA-3-384 or SHA-3-512)