NSA product types

The U.S. National Security Agency (NSA) used to rank cryptographic products or algorithms by a certification called product types. Product types were defined in the National Information Assurance Glossary (CNSSI No. 4009, 2010) which used to define Type 1, 2, 3, and 4 products. The definitions of numeric type products have been removed from the government lexicon and are no longer used in government procurement efforts.

A Type 1 product was a device or system certified by NSA for use in cryptographically securing classified U.S. Government information. A Type 1 product was defined as:

They were available to U.S. Government users, their contractors, and federally sponsored non-U.S. Government activities subject to export restrictions in accordance with International Traffic in Arms Regulations.

Type 1 certification was a rigorous process that included testing and formal analysis of (among other things) cryptographic security, functional security, tamper resistance, emissions security (EMSEC/TEMPEST), and security of the product manufacturing and distribution process.

A Type 2 product was unclassified cryptographic equipment, assemblies, or components, endorsed by the NSA, for use in telecommunications and automated information systems for the protection of national security information, as defined as:

A Type 3 product was a device for use with Sensitive, But Unclassified (SBU) information on non-national security systems, defined as:

Approved encryption algorithms included three-key Triple DES, and AES (although AES can also be used in NSA-certified Type 1 products). Approvals for DES, two-key Triple DES and Skipjack have been withdrawn as of 2015.

A Type 4 product was an encryption algorithm that was registered with NIST but is not a Federal Information Processing Standard (FIPS), defined as:

• NSA encryption systems, for a historically oriented list of NSA encryption products (most of them Type 1).
• NSA cryptography for algorithms that NSA has participated in the development of.
• NSA Suite B Cryptography
• NSA Suite A Cryptography

Parts of this article have been derived from Federal Standard 1037C, the National Information Systems Security Glossary, and 40 USC 1452.