The National Cryptographic Standards 3.5 Sharing Notice: White Key Derivation Functions (KDF) Accepted key derivation functions: • RFC 5869 (HKDF)4. • IKE-v2-KDF4. • TLS-v1.2-KDF4. • X9.63-KDF4. KDFs must comply with one of the following: • NIST-800-56 A/B KDF (Single Step)4. • NIST-800-56 C KDF (Extract-then-expand)4. • NIST-800-1084. 3.6 Key Agreement and Key Transport 3.6.1 Symmetric Schemes Accepted key agreement schemes: • Symmetric key agreement schemes must rely solely on shared long-term secrets. Accepted key transport schemes: • All symmetric encryption schemes and primitives can be used as per Section 2 and Section 3. • Combination of an encryption scheme with a MAC in encrypt-then-MAC mode (refer to Section 2 and Section 3). 3.6.2 Asymmetric Schemes: Key Exchange Algorithms Accepted key exchange algorithms: • Diffie-Hellman (DH) as in RFC 3526 . At least 3072 bits for key length for MODERATE. . Not accepted for ADVANCED. • Elliptic Curve Diffie-Hellman (ECDH) as in NIST SP 800-56A . 256-bit to 384-bit key for MODERATE. . 512-bit key or using Curve448 for ADVANCED. . With forward secrecy and authenticated key establishment implementation. • RSA Key Establishment (NIST 800-56B) . At least 3072 bits for key length for MODERATE. . Not accepted for ADVANCED. European Commission, “eCrypt Algorithms, Key Size and Protocols Report,” in eCrypt Algorithms, Key Size and Protocols Report, 2018. 4 Document Classification: Open 15