CNSA 2.0 and the quantum-safe deadline

What is CNSA 2.0?

CNSA 2.0, the Commercial National Security Algorithm Suite 2.0, is the set of public cryptographic algorithms NSA requires for protecting National Security Systems against both classical and quantum attack. It updates CNSA 1.0, the suite CNSSP 15 previously specified, and applies to unclassified and classified NSS alike.

NSA announced the suite in its September 2022 CNSA 2.0 cybersecurity advisory and keeps the detail in its CNSA 2.0 and Quantum Computing FAQ, last revised December 2024. CNSSP 15, the policy that sets commercial algorithms for NSS, has moved from NSA Suite B to CNSA 1.0 and now to CNSA 2.0.

It binds NSS owners and operators and the vendors who sell to them. Authorizing Officials assess cryptography under security control SC-12 in the Risk Management Framework, and commercial products in NSS must be NIAP-validated, which will generally require CNSA 2.0. Algorithms NSA developed sit outside the suite; high-grade equipment follows separate guidance, and Type 1 key management has operational limits of its own.

What does CNSA 2.0 require?

CNSA 2.0 requires AES with 256-bit keys, SHA-384 or SHA-512, ML-KEM-1024 for key establishment and ML-DSA-87 for digital signatures, with LMS or XMSS allowed for firmware and software signing. It deprecates RSA, Diffie-Hellman and elliptic-curve cryptography, the public-key algorithms of CNSA 1.0.

The suite as NSA’s FAQ defines it, for all classification levels:

NSA has also closed the doors buyers ask about. Larger RSA or elliptic-curve keys do not address the threat, SLH-DSA is not approved for any use in NSS, and NSA does not expect to add FN-DSA (Falcon).

When do the CNSA 2.0 deadlines hit?

For National Security Systems, CNSSP 15 requires new acquisitions to comply with CNSA 2.0 from January 1, 2027, phases out equipment that cannot support it by December 31, 2030, and mandates CNSA 2.0 algorithms by December 31, 2031, each unless otherwise noted. NSM-10 sets 2035 for full quantum resistance.

The fixed dates, per NSA’s FAQ and the White House:

Executive Order 14412, signed June 22, 2026, sets the separate dates for federal high value assets and high impact systems, excluding NSS. It also directs a proposed FAR rule requiring covered contractors to meet NIST’s FIPS, post-quantum algorithms included, by December 31, 2030. Our analysis of the post-quantum executive order covers the agency tasks.

NSA’s advisory also sets targets by product category. They predate the CNSSP 15 dates, so check each system against both.

Why does CNSA 2.0 leave AES-256 in place?

Quantum computing threatens public-key math, not symmetric ciphers. On a large enough quantum computer, Shor’s algorithm breaks RSA and elliptic-curve cryptography. Grover’s algorithm only speeds up brute-force key search quadratically, and a 256-bit AES key leaves a wide margin. NSA’s FAQ states that the CNSA 2.0 symmetric algorithms are quantum-resistant.

NSA’s advisory traces the problem to Peter Shor’s mid-1990s discovery that a cryptanalytically relevant quantum computer would break the public-key systems still in use. Symmetric cryptography faces a far weaker attack. NIST’s post-quantum cryptography FAQ explains that Grover’s algorithm at best lets an attacker brute-force a key twice as long as classical computers could, that the gain shrinks because the attack parallelizes poorly, and that AES-256 will remain safe for a very long time. Our briefing on why CNSA 2.0 favors symmetric cryptography goes further.

The urgency comes from harvest now, decrypt later. A joint CISA, NSA and NIST quantum-readiness factsheet warns that threat actors could be collecting data with a long secrecy lifetime today, and EO 14412 names the same risk. Our briefing on how adversaries price quantum into today’s collection covers the threat model.

What does CNSA 2.0 mean for PKI?

PKI sits at the center of the CNSA 2.0 migration. Today’s certificate chains are signed with RSA or elliptic-curve algorithms that CNSA 2.0 deprecates. Post-quantum PKI swaps the math but keeps certificate authorities, certificate lifecycles and persistent credentials, the stable key material that harvest-now-decrypt-later relies on.

NSA’s advisory groups large PKI systems with constrained devices as niche equipment, the last category due to prefer CNSA 2.0. The replacements are heavier: NSA’s FAQ notes that ML-KEM-1024’s larger public key cannot directly replace CNSA 1.0 key establishment in IKEv2, and that hybrid deployments add complexity plus a second transition later.

Upgrading PKI to post-quantum algorithms changes the math and leaves the architecture: certificates still expire, CAs still sit in the trust path, and credentials still persist. PKI was broken before quantum; CNSA 2.0 puts a date on the cost of keeping it. AKMSecure’s Autonomous Key Management™ (AKM) takes the other path and eliminates certificates. See how AKM and PKI compare.

How does Autonomous Key Management fit CNSA 2.0?

AKM is a symmetric-only architecture built on AES-256 with SHA-384/512, aligned to CNSA 2.0 symmetric-key guidance. It uses no RSA, Diffie-Hellman or elliptic-curve cryptography, so the key-management layer AKM covers needs no asymmetric migration. Compliance is determined for each system, not claimed by a vendor.

A pre-shared crypto seed generates key material. Symmetric keys refresh continuously and autonomously. Every packet is verified without a stored secret, and a self-healing mechanism restores availability. There are no certificate authorities, HSM integration is optional, and endpoints are provisioned once. How Autonomous Key Management works covers each step.

The SDK is sub-1MB, embeds in existing hardware and software, and is air-gapped capable. That suits the constrained devices NSA calls niche equipment, and key management for OT and industrial control systems, where PKI was never viable. Other parts of a system, such as firmware signing and links AKM does not protect, keep their own CNSA 2.0 obligations.

What should program offices do now?

Start with a cryptographic inventory, triage new acquisitions against the January 1, 2027 gate before the fielded estate, and choose architectures that won’t need a second migration. NSA’s advisory is clear that legacy equipment left unrefreshed will need a waiver and a plan to come into compliance.

• Inventory the cryptography. The CISA, NSA and NIST factsheet makes a cryptographic inventory central to quantum readiness: where quantum-vulnerable algorithms run, and how critical the data they protect is.
• Triage new acquisitions first. The 2027 gate covers what you buy next; NSA expects fielded equipment to transition by December 31, 2030. A triage plan for the NSS deadline starts with the acquisition pipeline.
• Map PKI dependencies. Systems that rely on classical certificates for device identity, code signing or session establishment are the hardest to move in time.
• Press vendors for roadmaps. The factsheet urges direct engagement with technology vendors on their quantum-readiness plans.
• Avoid a second migration. Hybrid deployments add a later transition. Prefer architectures with no quantum-vulnerable public-key dependency to swap out.
• Bring the Authorizing Official in early. CNSA 2.0 adoption is reported under NSM-10, and deviations go to NSA.