Sharing Notice: White 2.2 Asymmetric Algorithms 2.3 Hash Functions 2.4 Lightweight Crypto Algorithms The National Cryptographic Standards Accepted asymmetric algorithms: • RSA . At least 3072 bits for key length and “ ” value > 65537 for MODERATE. . Not accepted for ADVANCED. . Strong primes must be used. • Diffie-Hellman and Finite Field . At least 3072 bits for key length and “ ” value (subgroup size) of 256 for MODERATE. . Not accepted for ADVANCED. • Elliptic Curve Discrete Logarithm Problem based Algorithms (ECDLP) . NIST P-256, NIST P-384, BrainpoolP256r1, BrainpoolP384r1 and Curve25519 for MODERATE. . NIST P-521, Curve4483 and BrainpoolP512r1 for ADVANCED. Accepted hash functions: • Secure Hash Algorithm 2 (SHA-2) . SHA2-384 and SHA2-512/256 for MODERATE. . Not accepted for ADVANCED. • Secure Hash Algorithm 3 (SHA-3) . SHA3-256, SHA3-384, SHAKE128 and SHAKE256 for MODERATE. . SHA3-512 for ADVANCED. Common notes: • Hash functions must be inversion-resistant, pre-image resistant and collision resistant. • For SHAKE128, the output size “ ” value must be ≥256 bits. • For SHAKE256, the output size “ ” value must be ≥512 bits. • SHA2-384 and SHA2-512/256 are sometimes referred to as SHA-384 and SHA-512/256 respectively. Accepted lightweight algorithms (on limited systems with constrained resources, where the use of conventional cryptographic standards is not applicable): • Block ciphers (ISO/IEC 29192-2) . PRESENT, 80-bit or 128-bit key lengths. Curve448 is accepted for ADVANCED even though it operates at 224-bit security level because of its increased performance, resistance to a wide-range of side channel attacks and ease of implementation. 3 12 Document Classification: Open