Shock News: SHA-256, ECDH, ECDSA and RSA Not Approved by ASD in Australia for 2030

I am a bit shocked … SHA-256, RSA, ECDSA and ECDH will not be approved for use in Australia by 2030. Basically, these four methods are used for virtually every Web connection that we create, and where ECDH is used for the key exchange, ECDSA or RSA is used to authenticate the remote server, and SHA-256 is used for the integrity of the data sent. The removal of SHA-256 definitely goes against current recommendations.

From what I know at the current time, AES-256 and SHA-256 are safe from the risk of cracking from quantum computers. The guidance comes from the Australian Signals Directorate (ASD) and which exists within the Australian Government’s technical authority on cyber security: [here]:

The minimum levels of security are split into five main security levels.

• 112 bits for non-classified data
• 112 bits for OFFICIAL: Sensitive data.
• 112 bits for PROTECTED data.
• 128 bits for SECRET data.
• 192 bits for TOP SECRET data.

These relate to equivalent symmetric key security levels, such as where AES-128 relates to 128 bits of security. With elliptic curve methods, the P-256 curve gives 128 bits of security. For RSA, we have:

Strength  RSA modulus size
  80        1024
 112        2048
 128        3072
 192        7680
 256       15360

For the methods:

• AES. While it is known that AES-128 needs to be dropped due to Grover’s algorithm, the ASD recommends that both AES-128 and AES-192 will not be approved for use beyond 2030.
• RSA. For RSA, a modulus of at least 3,072 bits is recommended (128-bit security), but the RSA method, in general, will not be approved beyond 2030.
• Hashing. For hashing methods, it is known that we need to move to at least SHA-256 due to the risk of quantum computers, but SHA384 is now recommended. A shock is that both SHA-224 and SHA-256 will not be approved for use beyond 2030.
• MAC. For MAC methods, it is recommended to use HMAC-SHA256, HMAC-SHA384 or HMAC-SHA512, but HMAC-SHA256 will not be approved for use beyond 2030.
• DH and ECDH. At the present time, we need to use curves with at least 224 bits for the base point, and where P256 has 256-bit points. Overall, P384 is recommended, and where the usage of ECDH will not be approved for use beyond 2030.
• ECDSA. As with ECDH, we need at least 224 bits for the base point, but ECDSA will not be approved for use beyond 2030.

NIST has set the deprecations of ECC and RSA for 2030 and then removed in 2035, but Australia may be pushing for the removal of these methods by 2030. The migration within five years will not be easy, as every single Web connection currently uses ECDH and RSA/ECDSA. These methods are also used for many other parts of a secure infrastructure.

So, we now focus on the new NIST standards of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (FLH-DSA).

More information:

Does Willow Cause a Major Risk to Public Key Methods?

Should You Go Hybrid With Key Exchanges?