NIST SP 800-88 Rev 2 3.2.1: Strength of cryptography for CE: at least 128-bit security strength, entropy at least equal to the key length, and the Table 1 requirements on key generation, media encryption, key wrapping and key derivation

What does 3.2.1 require?

CE rests on symmetric-key encryption and its key management, so the algorithm (for example AES) and its mode are to be designed and built in such a way that an outsider can neither determine the decryption key nor derive plaintext without it. Following ISO/IEC 27040, the security strength of the algorithm and mode protecting the data is 128 bits or more and the entropy of the random sources is at least the number of bits in the keys (encryption, wrapping and derivation keys). The guideline narrows approved cryptography further: Table 1 ties key generation to SP 800-90A, 90B, 90C and SP 800-133; media encryption to FIPS 140-3, FIPS 197, SP 800-38A (ECB mode not allowed) and SP 800-38E; key level and wrapping to FIPS 197, SP 800-38A, SP 800-38F and SP 800-131A, with wrapping strength commensurate with the encryption; and key derivation to SP 800-90A, SP 800-108 and SP 800-133.