Saudi NCA National Cryptographic Standards (NCS-1:2020)
Saudi Arabia's national cryptographic standards: the MODERATE and ADVANCED strength levels; the accepted stream and block ciphers, asymmetric algorithms, hash functions and lightweight algorithms with key sizes per level; modes of operation, MACs, authenticated encryption, key wrap, key derivation, key agreement and transport, hybrid encryption and signatures; required configurations for IPsec, TLS, DNSSEC, SSH, Bluetooth, mobile networks, Wi-Fi and Kerberos; PKI certificate algorithms and validity limits; private key lifetimes and the full key lifecycle from generation to destruction and accounting; and the requirements on random number generation and side-channel resistance.
Saudi NCA National Cryptographic Standards (NCS-1:2020) is a compliance framework from Saudi Arabia with 7 domains and 30 controls. The largest domains are Section 3: accepted cryptographic schemes – Saudi NCA National Cryptographic Standards (NCS-1:2020) (8 controls), Section 4: commonly used cryptographic protocols – Saudi NCA National Cryptographic Standards (NCS-1:2020) (8 controls), Section 2: accepted cryptographic primitives – Saudi NCA National Cryptographic Standards (NCS-1:2020) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Section 1: scope, strength levels and structure – Saudi NCA National Cryptographic Standards (NCS-1:2020)
| Code | Title |
|---|---|
| saudi-nca-national-cryptographic-standards-ncs-1-2020::1.2 | Choose and implement the MODERATE or ADVANCED strength level for each class of data, system and network |
Section 2: accepted cryptographic primitives – Saudi NCA National Cryptographic Standards (NCS-1:2020)
| Code | Title |
|---|---|
| saudi-nca-national-cryptographic-standards-ncs-1-2020::2.1.1 | Stream ciphers: SNOW 2.0 and SOSEMANUK with unique IVs and single-use keys |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::2.1.2 | Block ciphers: AES, Camellia and Serpent at the key lengths for each level |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::2.2 | Asymmetric algorithms: RSA and finite-field DH at 3072 bits for MODERATE, elliptic curves by level |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::2.3 | Hash functions: SHA-2 (384 and 512/256) and SHA-3 by level |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::2.4 | Lightweight cryptography only where conventional algorithms cannot run, using the ISO/IEC 29192 families |
Section 3: accepted cryptographic schemes – Saudi NCA National Cryptographic Standards (NCS-1:2020)
| Code | Title |
|---|---|
| saudi-nca-national-cryptographic-standards-ncs-1-2020::3.1 | Block cipher modes: CTR, XTS-AES, OFB and CFB, with CBC for MODERATE only |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::3.2 | Message authentication codes: CMAC and HMAC with tags of at least 96 bits |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::3.3 | Authenticated encryption: GCM with 96-bit nonces and full tags, or CCM |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::3.4 | Key wrapping: KW and KWP |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::3.5 | Key derivation: HKDF, IKEv2, TLS 1.2 and X9.63 KDFs built on the NIST SP 800-56 or 800-108 constructions |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::3.6 | Key agreement and transport: shared long-term secrets for symmetric schemes; DH, ECDH and RSA key establishment by level with forward secrecy |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::3.7 | Hybrid encryption: ECIES for both levels, DLIES and RSA-OAEP for MODERATE |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::3.8 | Digital signatures: DSA and RSA (PSS or DS2) at 3072 bits for MODERATE, ECDSA by level, Merkle signatures with accepted hashes |
Section 4: commonly used cryptographic protocols – Saudi NCA National Cryptographic Standards (NCS-1:2020)
| Code | Title |
|---|---|
| saudi-nca-national-cryptographic-standards-ncs-1-2020::4.1 | IPsec: ESP and AH with SHA-2/SHA-3 HMACs by level, AES or Camellia in CTR, or CCM/GCM with 12 or 16-byte ICVs |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::4.2 | TLS: 1.2 with the listed suites and no downgrade, 1.3 recommended with TLS_AES_256_GCM_SHA384 |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::4.3 | DNSSEC: ECDSA P-384 with SHA-384 for zone signing, HMAC-SHA384 or HMAC-SHA512 for transaction authentication |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::4.4 | SSH: version 2 only with AES-GCM authenticated encryption by level |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::4.5 | Bluetooth: version 4.1 or later in Security Mode 4 Level 4 with AES-CCM, P-256 secure connections and full encryption |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::4.6 | Mobile networks: the 128-bit UMTS, LTE and 5G algorithm sets, with EIA0/NIA0 only for emergency calls |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::4.7 | Wi-Fi: WPA3-Enterprise only |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::4.8 | Kerberos: Camellia-CTS-CMAC and AES256-CTS-HMAC-SHA384 encryption types by level |
Section 5: public key infrastructure – Saudi NCA National Cryptographic Standards (NCS-1:2020)
| Code | Title |
|---|---|
| saudi-nca-national-cryptographic-standards-ncs-1-2020::5.1 | Certificate algorithms: 4096-bit RSA or strong curves for roots, 3072-bit RSA or accepted curves below, SHA-2/SHA-3 and X.509 compliance |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::5.2 | Certificate validity: 20 years for roots, 10 for intermediates, 5 or 3 years for end users by level |
Section 6: key lifecycle management – Saudi NCA National Cryptographic Standards (NCS-1:2020)
| Code | Title |
|---|---|
| saudi-nca-national-cryptographic-standards-ncs-1-2020::6.1 | Private key lifetime: hardware modules for 5 or 3 years by level, software modules for 2 years at MODERATE only |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::6.2a | Key generation, registration and distribution |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::6.2b | Key use and storage |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::6.2c | Key revocation, validation, archive, destruction and accounting |
Section 7: appendices (random number generation, side channels, definitions) – Saudi NCA National Cryptographic Standards (NCS-1:2020)
| Code | Title |
|---|---|
| saudi-nca-national-cryptographic-standards-ncs-1-2020::7.1 | Random number generation: dedicated cryptographic generators, tested, never language library functions |
| saudi-nca-national-cryptographic-standards-ncs-1-2020::7.3 | Side-channel resistance: certified hardware for secret keys, laboratory analysis and MAC-then-verify |
What is Saudi NCA National Cryptographic Standards (NCS-1:2020) and who does it apply to?
Saudi NCA National Cryptographic Standards (NCS-1:2020) is a compliance framework from Saudi Arabia with 7 domains and 30 controls. Saudi Arabia's national cryptographic standards: the MODERATE and ADVANCED strength levels; the accepted stream and block ciphers, asymmetric algorithms, hash functions and lightweight algorithms with key sizes per level; modes of operation, MACs, authenticated encryption, key wrap, key derivation, key agreement and transport, hybrid encryption and signatures; required configurations for IPsec, TLS, DNSSEC, SSH, Bluetooth, mobile networks, Wi-Fi and Kerberos; PKI certificate algorithms and validity limits; private key lifetimes and the full key lifecycle from generation to destruction and accounting; and the requirements on random number generation and side-channel resistance. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Saudi NCA National Cryptographic Standards (NCS-1:2020) actually require?
Saudi NCA National Cryptographic Standards (NCS-1:2020) has 30 controls organised across 7 domains. The largest domains are Section 3: accepted cryptographic schemes – Saudi NCA National Cryptographic Standards (NCS-1:2020) (8 controls), Section 4: commonly used cryptographic protocols – Saudi NCA National Cryptographic Standards (NCS-1:2020) (8 controls), Section 2: accepted cryptographic primitives – Saudi NCA National Cryptographic Standards (NCS-1:2020) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Saudi NCA National Cryptographic Standards (NCS-1:2020) do I already cover?
Saudi NCA National Cryptographic Standards (NCS-1:2020) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Saudi NCA National Cryptographic Standards (NCS-1:2020)?
Start your Saudi NCA National Cryptographic Standards (NCS-1:2020) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Saudi NCA National Cryptographic Standards (NCS-1:2020) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 30 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required