NSA Guidance for Transition to Quantum-Resistant Cryptography Q-NOVEL: Q-NOVEL Consult NSA before using cryptography CNSA does not specify; no lightweight ciphers

NSS owners must consult NSA before using any cryptography that CNSA 1.0, CNSA 2.0 and NSA's published guidance do not specify. The FAQ names areas with no generally approved NSS solution: private information retrieval, private set intersection, identity-based and attribute-based encryption, homomorphic encryption, group, ring and threshold signatures, searchable encryption and others it lists. NSA does not validate novel vendor cryptography on request; an NSS customer with a mission need engages NSA directly. NSA will not add NIST's lightweight (Ascon-based) ciphers to CNSA, and if CNSA 2.0 does not meet mission performance, early consultation with NSA is required.