What CNSA 2.0 is
CNSA 2.0 is the National Security Agency's designated set of quantum-resistant cryptographic algorithms for National Security Systems (NSS) — and, by extension, a north star for the vendors, integrators, and enterprises that supply them. Announced in 2022, it replaces the earlier CNSA 1.0 suite, whose RSA and elliptic-curve algorithms are broken by a sufficiently capable quantum computer running Shor's algorithm.
The important shift is one of posture. CNSA 1.0 was about choosing strong classical parameters. CNSA 2.0 is about replacing the underlying mathematics entirely — moving to algorithms whose security does not collapse in the presence of a cryptographically relevant quantum computer.
The approved algorithms
CNSA 2.0 standardizes on a small, deliberately conservative set of primitives, each aligned to the finalized NIST standards:
| Key establishment | ML-KEM (FIPS 203, derived from CRYSTALS-Kyber) — Level 5 parameters (ML-KEM-1024). |
| Digital signatures | ML-DSA (FIPS 204, derived from CRYSTALS-Dilithium) — Level 5 parameters (ML-DSA-87). |
| Software & firmware signing | LMS or XMSS — stateful hash-based signatures for signing code and firmware. |
| Symmetric encryption | AES-256 — already quantum-resistant at this key size. |
| Hashing | SHA-384 or SHA-512. |
Two things stand out. First, the suite prefers the highest security levels, not the smallest — a design choice that trades a little bandwidth for a long margin of safety. Second, it separates signing from key exchange, because they migrate on very different clocks.
The transition timeline
CNSA 2.0's published timeline is staggered by technology category, reflecting how hard each is to update. The headline dates:
- Software and firmware signing — begin immediately; support and prefer CNSA 2.0 by 2025, with exclusive use by 2030. This goes first because signed artifacts must be verifiable for years after they ship.
- Networking equipment (VPNs, routers) — support and prefer by 2026; exclusive use by 2030.
- Operating systems, web browsers/servers, and cloud services — support and prefer around 2025–2027; exclusive use by 2033.
- Niche and custom systems — transitioned by 2033.
The guiding goal: National Security Systems should be fully migrated to quantum-resistant algorithms by 2035. Every category is expected to be well underway years earlier.
Why it matters even if you're not a defense supplier
CNSA 2.0 sets the tempo for the wider market. Federal procurement, critical infrastructure, and regulated industries routinely inherit NSA guidance as a de-facto baseline, and commercial certificate authorities, browsers, and cloud providers are aligning their roadmaps to the same standards. If your organization sells into these channels — or simply wants a defensible answer when auditors ask about quantum readiness — CNSA 2.0 is the reference point.
It also removes a common excuse. Migration is no longer waiting on standards: the algorithms are finalized, the timeline is public, and the deprecation dates are close enough to matter for any data that must stay confidential into the 2030s.
What to do about it
- Inventory where RSA, ECDSA, and Diffie–Hellman live across your estate — you cannot migrate what you have not mapped.
- Prioritize by data lifetime: anything that must remain secret past ~2030 is already exposed to harvest-now-decrypt-later.
- Start with signing and key exchange, deployed in hybrid mode, so a weakness in either the classical or post-quantum algorithm still leaves you protected.
- Build crypto-agility now, so the next parameter change is a configuration update rather than a re-architecture.
Where does CNSA 2.0 leave your organization?
We'll map your cryptography against the CNSA 2.0 timeline and hand you a prioritized migration roadmap.
Request an assessmentThis primer is an educational overview of publicly available guidance and is not legal or compliance advice. Confirm current dates and parameters against the NSA's official CNSA 2.0 publications.