CNSA 2.0: the algorithms and the deadlines
CNSA 2.0 is NSA's set of quantum-resistant algorithms for US national security systems: ML-KEM-1024, ML-DSA-87, AES-256, SHA-384 or SHA-512, and LMS or XMSS for signing software and firmware. Each kind of system has its own deadline to use them exclusively, from 2030 to 2033, and all national security systems are to be quantum-resistant by 2035.
Checked against the sources on 27 October 2026.
What it is, and who it applies to
The Commercial National Security Algorithm Suite 2.0 was announced by NSA in September 2022. It sets the algorithms for national security systems — systems that handle classified information or are otherwise critical to military and intelligence missions — and so for the vendors and contractors who build products for them. National Security Memorandum 10 sets the overall goal of moving these systems to quantum-resistant cryptography by 2035.
Federal civilian systems follow a different instrument, OMB M-26-15, which explicitly excludes national security systems. See a post-quantum migration roadmap for its dates.
The algorithms
| Purpose | Algorithm | Standard |
|---|---|---|
| Key establishment | ML-KEM-1024 | FIPS 203 |
| Digital signatures | ML-DSA-87 | FIPS 204 |
| Symmetric encryption | AES-256 | FIPS 197 |
| Hashing | SHA-384 or SHA-512 | FIPS 180-4 |
| Software and firmware signing | LMS or XMSS | NIST SP 800-208 |
CNSA 2.0 takes the highest parameter set of each post-quantum algorithm: ML-KEM-1024 rather than ML-KEM-768, ML-DSA-87 rather than ML-DSA-65. An estate that standardises on the smaller sets for general use needs the larger ones wherever CNSA 2.0 applies.
The deadlines
NSA sets two dates for each kind of system: when products should support and prefer CNSA 2.0 algorithms, and when they must use them exclusively.
| Kind of system | Support and prefer by | Use exclusively by |
|---|---|---|
| Software and firmware signing | 2025 | 2030 |
| Web browsers, servers and cloud services | 2025 | 2033 |
| Traditional networking equipment (VPNs, routers) | 2026 | 2030 |
| Operating systems | 2027 | 2033 |
| Niche equipment (constrained devices, large PKI systems) | 2030 | 2033 |
| Custom applications and legacy equipment | Update or replace by 2033 | |
NSA's updated FAQ also expects new acquisitions for national security systems to be CNSA 2.0 compliant from 1 January 2027. Check the FAQ for the current wording before relying on any date for a contract.
How to prepare
- Inventory where each system's cryptography is — in code, in dependencies and on the network — and record which of the categories above each one falls under. A CBOM is the natural format.
- Start with signing. Software and firmware signing has the earliest exclusive-use date, and its signatures are trusted for the life of the device.
- Ask vendors for their CNSA 2.0 roadmaps, especially for networking equipment, which must be exclusive by 2030.
- Plan for size. ML-DSA-87 signatures are 4,627 bytes and ML-KEM-1024 public keys 1,568 bytes; test constrained links and devices early. See ML-DSA vs ECDSA for certificates.