What is CNSA 2.0?
CNSA 2.0 is the set of quantum-resistant algorithms that the US National Security Agency requires for US national security systems, with a schedule for moving to them. NSA announced it in September 2022 and has since updated its advisory. It doesn't apply to banks or other private organisations directly. It matters anyway, because the vendors that sell to the US government build it into products everyone else buys, and because it shows how a large organisation turns post-quantum standards into deadlines.
The algorithms
| CNSA 2.0 choice | |
|---|---|
| Agreeing on keys | ML-KEM-1024 |
| General signatures | ML-DSA-87 |
| Signing software and firmware | LMS or XMSS (stateful hash-based signatures) |
| Encryption | AES-256 |
| Hashing | SHA-384 or SHA-512 |
The schedule
| Support and prefer by | Use exclusively by | |
|---|---|---|
| Software and firmware signing | 2025 | 2030 |
| Web browsers, servers and cloud services | 2025 | 2033 |
| Traditional networking equipment, such as VPNs and routers | 2026 | 2030 |
| Operating systems | 2027 | 2033 |
| Niche equipment, such as constrained devices | 2030 | 2033 |
| Custom applications and legacy equipment | No separate date | Update or replace by 2033 |
Why it matters outside government
Hardware security modules, network equipment, operating systems and cloud services are sold to governments and banks alike. When vendors add CNSA 2.0 support, those capabilities reach commercial customers too. The schedule also gives a useful outside view of sequencing: software signing and network equipment first, because they protect everything else.
For a bank, CNSA 2.0 is a reference point, not a requirement. Banks generally follow their own regulators and NIST's guidance, which allows smaller parameter sets than CNSA 2.0.
Common confusions
- "It applies to everyone in the US." No. It applies to national security systems.
- "It means AES-128 is broken." No. Choosing AES-256 is a conservative policy choice; NIST considers AES-128 adequate against quantum attacks.
- "It allows every NIST algorithm." No. It leaves out SLH-DSA and FN-DSA, among others.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- Government guidanceNSA releases future quantum-resistant algorithm requirements for national security systems (CNSA 2.0)US National Security Agency, 2022
- Government guidanceAnnouncing the Commercial National Security Algorithm Suite 2.0 (advisory, updated 2025)US National Security Agency, 2025
- Government guidanceThe Commercial National Security Algorithm Suite 2.0 and quantum computing FAQUS National Security Agency
- Government guidanceNIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography StandardsNIST, 2024