DataTerminology.comNEW
Also known as: Suite B
An NSA-defined set of public cryptographic algorithms—primarily ECC, AES, and SHA-2—standardized for protecting national security systems.
DESCRIPTION
Suite B specified a cohesive set of modern algorithms—AES for encryption, SHA-2 for hashing, and elliptic-curve–based ECDH/ECDSA for key exchange and signatures—used in U.S. national security systems. It was profiled in IETF standards for IPsec and TLS to enable interoperable secure communications. NSA has since transitioned to the Commercial National Security Algorithm (CNSA) Suite, which expands guidance and prepares for post-quantum transition. Suite B remains historically significant for normalizing ECC in government and industry protocols and for its role in certifying algorithm strengths. Implementations often required FIPS 140 validation and adherence to protocol profiles. It influenced PKI certificate profiles, key sizes, and cipher suite selections across defense and federal environments.
ALTERNATIVE DEFINITIONS
IETF RFC 6379
This document defines two IKEv2/IPsec cryptographic suites that comply with the U.S. National Security Agency (NSA) Suite B Cryptography.
Defines Suite B–compliant cryptographic suites specifically for IPsec/IKEv2 profiles.
IETF RFC 6460
This document specifies a profile for the use of Transport Layer Security (TLS) version 1.2 with the U.S. National Security Agency (NSA) Suite B Cryptography.
Provides the TLS 1.2 profile that operationalizes Suite B algorithm choices.
RELATED TERMS
Elliptic Curve Cryptography Rijndael SHA-2 ECDSA Elliptic-Curve Diffie–Hellman TLS IPsec Protocol Suite FIPS 140-3 Public Key Infrastructure
COMPETING TERMS
Commercial National Security Algorithm Suite
KNOWLEDGE AREAS
Data Security Cloud Infrastructure
TARGET AUDIENCE
Security Architect Chief Information Security Officer Cybersecurity Engineer Cloud Architect Solution Architect DevOps Engineer Software Architect
EXTERNAL SOURCES
- Wikipedia - Suite B Cryptography
- IETF - IPsec suites aligned to Suite B
- IETF - TLS 1.2 Suite B profile
- NSA - CNSA replaces Suite B
- NIST - ECC key agreement guidance
TOP QUESTIONS
What algorithms are included in NSA Suite B?
Suite B centers on AES for encryption, SHA-2 for hashing, and elliptic-curve primitives ECDH and ECDSA for key exchange and digital signatures. These were profiled into TLS and IPsec.
Category: Definition
Why did NSA Suite B transition to CNSA?
NSA introduced CNSA to update guidance, align with evolving threat models, and prepare for post-quantum cryptography. CNSA supersedes Suite B in modern deployments.
Category: Relevancy
How was Suite B used in TLS and IPsec?
IETF RFCs defined TLS and IPsec profiles selecting Suite B algorithms, ensuring interoperability between compliant implementations across government and industry systems.
Category: Application
Is Suite B still approved for new systems?
New U.S. national security systems are directed toward CNSA guidance. Suite B remains historically important but is not the forward-looking recommendation.
Category: Policy
What strengths did Suite B standardize?
It normalized ECC-based ECDH/ECDSA, AES-128/256, and SHA-256/384, providing balanced security and performance for high-assurance environments.
Category: Details
Did Suite B require FIPS validation?
Implementations typically required FIPS 140 validation for modules, especially in U.S. federal contexts, to assure cryptographic module integrity and robustness.
Category: Compliance
How does Suite B relate to PKI?
Suite B influenced certificate profiles, key sizes, and signature algorithms, including ECDSA and SHA-2 within government PKIs.
Category: Integration
What is the risk of continuing Suite B in new designs?
Relying on superseded profiles risks noncompliance and future migration costs. Aligning with CNSA and post-quantum planning mitigates future-proofing risks.
Category: Risk
Where can I find official Suite B profiles?
Consult IETF RFCs 6379 (IPsec) and 6460 (TLS) for standardized Suite B cryptographic suites and usage profiles.
Category: Resources