CBOM & nistQuantumSecurityLevels

[Dimitri John Ledkov]

Hi,

Is there a well known list of algorithms and their NIST Quantum Security Levels?

For example, what is NIST Quantum Security Level for SHA1 (still used
in old root CA certificates) and HMAC-SHA1 (still in use for 2FA using
TOTP)?

And in CBOM, should
https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_cryptoProperties_algorithmProperties_nistQuantumSecurityLevel
should the NIST Quantum Security Level be assigned to non-NIST
algorithms?

For example, does Blake2b have NIST Quantum Security Level (no
property specified in the CBOM), or is it zero (because it is non-NIST
/ non-FIPS algorithm), or is it 2 similar to SHA-256?

--
Regards,

Dimitri.

[Brent Kimberley]

Excellent question.

It would be nice to have an easy to reference for postquantum algorithms.
Something like the second table in https://www.keylength.com/en/4/ : NIST


-----Original Message-----
From: pqc-...@list.nist.gov <pqc-...@list.nist.gov> On Behalf Of Dimitri John Ledkov
Sent: August 12, 2026 2:11 PM
To: pqc-forum <pqc-...@list.nist.gov>
Subject: [pqc-forum] CBOM & nistQuantumSecurityLevels

[You don't often get email from dimitri...@surgut.co.uk. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

⚠️CAUTION: This email is from an external source. Verify sender before opening links and attachments.⚠️

--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.
To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CANBHLUge%3DqqcA50RWqdrB7XnNDuuMUewcMn2WUdkqKCd2-%3DWcA%40mail.gmail.com.

[David Cooper]

For NIST algorithms, see Section 4.6.1 of
https://doi.org/10.6028/NIST.SP.800-57pt1r6.ipd. It is still a draft, so
it may change before the final version is published, but it should still
be useful.

[Jack Grigg]

Hi Dimitri,

 

On Wed, 12 Aug 2026, 7:11 pm Dimitri John Ledkov, <dimitri...@surgut.co.uk> wrote:

Hi,

Is there a well known list of algorithms and their NIST Quantum Security Levels?

Not that I'm aware of. You can build this list yourself based on the definitions of the NIST PQC security categories (often misleadingly referred to as "levels" - it isn't a single sliding scale):

- Categories 1, 3, and 5 are algorithms that must resist attacks at least as hard as breaking AES-128 / AES-192 / AES-256 (respectively) by exhaustive key search (i.e. trying all 2^128 / 2^192 / 2^256 keys respectively).

- Categories 2 and 4 are algorithms that must resist attacks at least as hard as finding a collision in SHA-256 / SHA-384 (respectively). These are the same effective security levels as categories 1 and 3, but for a different attack (hash collisions, so 2^128 / 2^192 operations respectively).

There is no "level 0" (or level 6 for that matter). There is only "less secure than AES-128 or SHA-256" (or Category 4 or 5 for everything more secure than SHA-384 or AES-256).

For example, what is NIST Quantum Security Level for SHA1 (still used
in old root CA certificates)

SHA1 is classically broken, so it is by definition less secure than SHA-256, and thus has no category. (This was also the case even before it was broken, as brute-force hash collisions required 2^80 operations.)

and HMAC-SHA1 (still in use for 2FA using
TOTP)?

HMAC-SHA1 is not classically broken; it isn't vulnerable to collision attacks due to its structure, so Categories 2 and 4 are not relevant. Its practical strength depends on the length of the key. The recommended key length for HMAC is the same as the output size of the hash function, so assuming HMAC-SHA1 with 160-bit keys, that would make it Category 1 (>= 2^128, < 2^192).

And in CBOM, should
https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_cryptoProperties_algorithmProperties_nistQuantumSecurityLevel
should the NIST Quantum Security Level be assigned to non-NIST
algorithms?

For example, does Blake2b have NIST Quantum Security Level (no
property specified in the CBOM), or is it zero (because it is non-NIST
/ non-FIPS algorithm), or is it 2 similar to SHA-256?

BLAKE2b has a default output size of 512 bits (assuming you don't set a different length), and thus you can brute force hash collisions in around 2^256 operations, making it Category 4 (>= 2^192).

Cheers,

Jack

[Richard Kettlewell]

On 12/08/2026 19:10, Dimitri John Ledkov wrote:
> For example, what is NIST Quantum Security Level for SHA1 (still used
> in old root CA certificates) and HMAC-SHA1 (still in use for 2FA using
> TOTP)?
>
> And in CBOM, should
> https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_cryptoProperties_algorithmProperties_nistQuantumSecurityLevel
> should the NIST Quantum Security Level be assigned to non-NIST
> algorithms?

The NIST definitions are comparisons with specific algorithms (AES and
SHA2) and do not mention any kind of approval status, so I think the
security levels apply just as well to non-NIST algorithms as to NIST
algorithms.

The certificationLevel field seems more appropriate for documenting
compliance levels. It covers the specific implementation rather than the
algorithm but that may be more useful in a compliance context anyway?

ttfn/rjk

[LJEPOSAVA DIMITRIJEVIC]

https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_cryptoProperties_algorithmProperties_nistQuantumSecurityLevel

[John Mattsson]

Hi Dimitri,

In general don't fill anything that you don't know. Incorrect info is worse than no info. Also security levels change over time. It should according to me not be in CBOMs at all.

>should the NIST Quantum Security Level be assigned to non-NIST algorithms?

I think the "NIST" security levels should be used everywhere instead of "bits of security". For example I think ECCG ACM should transition to the 5 "NIST" security levels.

>For example, what is NIST Quantum Security Level for SHA1 (still used

>in old root CA certificates)

The security level of SHA1 against collision attacks is 0, but the signature in self-signed root certificates have no security relevance, so you should not assign it a security level at all.

>For example, does Blake2b have NIST Quantum Security Level (no

>property specified in the CBOM), or is it zero (because it is non-NIST / non-FIPS algorithm), or is it 2 similar to SHA-256?

The security level of Blake2b depends on the both the output size and the use case.

- Blake2b-512 has the same level as SHA-512, i.e., 5.

- Blake2b-256 has the same level as SHA-512/256, i.e., 2 or 5.

See Table 6 of https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r6.ipd.pdf

Cheers,

John Preuß Mattsson