NSA Guidance for Transition to Quantum-Resistant Cryptography T-NET: T-NET Traditional networking equipment such as VPNs and routers: support and prefer by 2026, exclusive use by 2030

Traditional networking equipment, for example virtual private networks and routers, must support and prefer CNSA 2.0 by 2026 and use it exclusively by 2030. The CSfC addendum places IPsec gateways, MACsec gateways and WLAN access systems in this class; for IPsec NSA expects the CNSA 2.0 IPsec profile, in which a CNSA 1.0 initial IKEv2 exchange is followed by an ML-KEM-1024 exchange in an intermediate exchange (RFC 9370 and RFC 9242, with IKEv2 fragmentation under RFC 7383) because the ML-KEM-1024 key is too large for the initial message.