Under Annex C, any key-encryption key used to transmit or convey another key must be no weaker than the key it protects. TDEA KEKs are at least double-length and run in encrypt-decrypt-encrypt mode, and they never protect AES keys or any key stronger than 112 bits; a TDEA key of double or triple length is never encrypted under a TDEA key of lesser strength; and RSA transport keys offer at least 80 bits of strength, rising to 112 bits where the key being carried is stronger than 80 bits.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.