New FAQ for CNSA 2.0

1,836 views
Skip to first unread message

Stern, Morgan B

unread,
Apr 18, 2024, 3:02:58 PM4/18/24
to pqc-...@list.nist.gov
NSA has updated our guidance on our Commercial National Security Algorithm Suite 2.0 (CNSA 2.0): https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/1/CSI_CNSA_2.0_FAQ_.PDF

CNSA 2.0 will be required to protect US National Security Systems (NSS) in the future. Based on our stakeholders' feedback we have added answers to a variety of new questions in our FAQ. This includes:

-Clarification that only single-tree variants of SP 800-208's stateful hash-based signature algorithms are allowed in CNSA 2.0
-Added details regarding the flexibilities allowed in the signing infrastructures of commercial hardware/software manufacturers so that vendors can comply with the timelines of our quantum resistant signing requirements for their firmware/software.
-Clarification that ML-DSA-87 can be used for software/firmware signing, though we expect a longer time period before its availability, and so it may not meet our hardware deadlines.
-Added context on our views on hybrid key establishment.
-Clarification that only cryptographic primitives in CNSA can be used in commercial products to protect NSS. Cryptographic functionality provided by primitives not included in CNSA do not have any approved commercial solutions and we explicitly list some such functionality.

Looking forward to continued community engagement. Thanks for the questions over the last few years.

Morgan Stern
NSA Cybersecurity

John Mattsson

unread,
May 19, 2024, 9:38:10 AM5/19/24
to Stern, Morgan B, pqc-...@list.nist.gov

Dear Morgan Stern,

 

Thanks for the clarification that ML-DSA-87 can be used also for software/firmware signing and that multitree algorithms are not allowed. That was not clear in the original document.

 

I am looking forward to implementation guidance for CNSA 2.0 similar to the IETF RFCs produced for CNSA 1.0. I particularly liked how the CNSA 1.0 RFCs mandated several things that are only MAY or SHOULD in the original protocol specifications. Several things from the CNSA 1.0 RFCs has been adopted by 3GPP after contributions from Ericsson. Having public recommendations from organisations such as NSA, NIST, BSI, or ANSSI makes it much easier to strengthen security in various standards.

 

One thing in the new FAQ that seems to confuse people is the texts "Can I use SLH-DSA (aka SPHINCS+) to sign software?" and "Q: Can I use SHA-3 as a hash?". Some people read this as new information from NSA regarding the security of SLH-DSA and SHA-3. If NSA updated the FAQ it would be good to clarity that CNSA 2.0 tries to include as few algorithms as possible,  that everything that is not explicitly approved is not approved, and that not being approved does not mean that NSA has concluded that the security is bad. In fact, I read the text "The SHA-2 selections are sufficient for security" as NSA agreeing that SHA-3 is technically superior (except for compatibility with existing NSA systems).

Cheers,

John Preuß Mattsson

 



CNSA 2.0 will be required to protect US National Security Systems (NSS) in the future. Based on our stakeholders' feedback we have added answers to a variety of new questions in our FAQ. This includes:

-Clarification that only single-tree variants of SP 800-208's stateful hash-based signature algorithms are allowed in CNSA 2.0
-Added details regarding the flexibilities allowed in the signing infrastructures of commercial hardware/software manufacturers so that vendors can comply with the timelines of our quantum resistant signing requirements for their firmware/software.
-Clarification that ML-DSA-87 can be used for software/firmware signing, though we expect a longer time period before its availability, and so it may not meet our hardware deadlines.
-Added context on our views on hybrid key establishment.
-Clarification that only cryptographic primitives in CNSA can be used in commercial products to protect NSS. Cryptographic functionality provided by primitives not included in CNSA do not have any approved commercial solutions and we explicitly list some such functionality.

Looking forward to continued community engagement. Thanks for the questions over the last few years.

Morgan Stern
NSA Cybersecurity

Reply all
Reply to author
Forward
0 new messages