Portal:Committee on National Security Systems

“ In the context of today’s complex world and even more complex communicating environments, the need for protecting information takes on added importance and significance. The protection of information is not solely dependent on the mathematical strength of an algorithm that may be a part of a communications security device or a communications system, nor is the selection of that algorithm based only on the classification of the information to be protected. Many factors come into play in deciding what algorithm can or should be used to satisfy a particular requirement. ”

“ The design and strength of all key lengths of the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level. TOP SECRET information will require use of either the 192 or 256 key lengths. The implementation of AES in products intended to protect national security systems and/or information must be reviewed and certified by NSA prior to their acquisition and use. ”

“ These include:
- The quality of implementation of the algorithm in specific software, firmware, or hardware - Operational requirements associated with U.S. Government-approved key and key management activities; - The uniqueness of the classified information to be protected; and/or - Requirements for interoperability both domestically and internationally. (3) The above realities dictate the adoption of a flexible and adaptable strategy that encourages the use of a mix of appropriately implemented NSA-developed algorithms, and those available within the public domain. ”