up:: The Mandates MOC

ANSSI vs BSI vs NCSC vs NSA on Hybrid

The four authorities disagree about hybrid cryptography because they’re protecting against different things: France and Germany hedge against a young post-quantum algorithm turning out to be broken, the United Kingdom hedges against carrying permanent complexity that stops helping the moment a quantum computer exists, and the United States isn’t hedging at all, because CNSA 2.0 treats hybrid as an interoperability detail and puts all of its weight on fixed deadlines and maximum parameter sizes instead.

Every one of those positions is internally correct. They differ because the four agencies are answering different questions, and a product sold into more than one of these jurisdictions has to satisfy all four answers at once.

The short version:

• France (ANSSI) is the strictest. Hybrid is required for products it certifies, in its own words a product “shall implement hybridation,” with hash-based signatures the one exception.
• Germany (BSI) is aligned with France, recommending hybrid for long-term confidentiality, and ANSSI names that alignment explicitly in its own position paper rather than leaving it to be inferred.
• The UK (NCSC) treats hybrid as a bridge. Its position is that hybrid should be “used as an interim measure” inside a flexible framework enabling a straightforward move to PQC-only later.
• The US (CNSA 2.0) is deadline-driven. Hybrid is permitted where interoperability needs it, and it buys no extra time, because selecting a CNSA 1.0 algorithm alone stops being approved on the published dates regardless.
• The split is 2 + 1 + 1, not four-way: a Franco-German bloc, a British outlier, and an American position that sits outside the argument entirely.

Picture a building where the load-bearing wall has to be replaced with a new steel frame. France and Germany say leave the old wall standing while the frame goes in, because the frame is new and nobody has watched it hold a roof through a winter yet. The UK says the old wall comes out once the frame is certified, since leaving it in adds cost and clutter without adding strength once you trust the frame. The US says it doesn’t much care which way you sequence it, so long as the frame is installed by the deadline and it’s the heaviest grade the mill makes.

What is hybrid cryptography in this context?

A hybrid scheme runs a classical algorithm and a post-quantum algorithm together and combines their outputs, so that breaking the combination requires breaking both halves. The NCSC’s definition is the tightest of the four: a post-quantum/traditional hybrid scheme combines “one (or more) PQC algorithms with one (or more) traditional PKC algorithms where all component algorithms are of the same type.”

The appeal is straightforward. If the post-quantum algorithm turns out to have a flaw, the classical half is still standing, so the system is no weaker than it was before. If a quantum computer arrives, the classical half falls and the post-quantum half carries the traffic. Full mechanics are in Hybrid Cryptography.

The disagreement isn’t about how hybrid works. All four agencies understand it the same way. They disagree about how long you should carry it, and whether an authority should require it.

How do ANSSI, BSI, NCSC, and NSA compare on hybrid?

Dimension	🇫🇷 ANSSI	🇩🇪 BSI	🇬🇧 NCSC	🇺🇸 NSA (CNSA 2.0)
Posture on hybrid	Required through phases 1 and 2	Recommended for long-term confidentiality	Interim measure; PQC-only is the destination	Permitted for interoperability; changes no deadline
Binding force	Mandatory for certified end products (“shall implement hybridation”)	Technical-guideline recommendation	Recommendation	Mandatory algorithm selection at fixed dates
Applies to signatures	Yes, except hash-based (XMSS, LMS, SPHINCS+)	Yes, hybrid construction provided	Not framed as a hybrid requirement	Yes, ML-DSA-87
Failure mode being hedged	A young post-quantum algorithm falling	A young algorithm falling, plus harvest-now-decrypt-later	Complexity that stops paying once a CRQC exists	Missing the deadline
Named algorithms	No closed list; prefers NIST level 5, else level 3	ML-KEM and ML-DSA, plus FrodoKEM and Classic McEliece	ML-KEM-768 and ML-DSA-65	ML-KEM-1024 and ML-DSA-87
Classical baseline	AES-256 and SHA2-384 equivalents	RSA-3000	Not specified in these terms	CNSA 1.0 until superseded
When hybrid ends	Phase 3, “probably not earlier than 2030”	Not dated	When a clean move to PQC-only is available	Not applicable
Published dates	Phase 2 from about 2025; phase 3 from about 2030	TR-02102 revised annually	2028, 2031, 2035	2027, 2030, 2031

Source: ANSSI, “ANSSI views on the Post-Quantum Cryptography transition,” March 30, 2022, PDF; and “(2023 follow up),” December 21, 2023, PDF.

Source: BSI, TR-02102-1 Version 2026-01, PDF, §1, §2.2, §5.3.4.

Source: NCSC, “Next steps in preparing for post-quantum cryptography,” Version 2.0, August 14, 2024, whitepaper; and “Timelines for migration to post-quantum cryptography,” March 20, 2025, guidance.

Source: NSA, “CNSA 2.0 FAQ,” PP-24-4014, December 2024 update, PDF.

Does ANSSI require hybrid cryptography?

For anything France certifies, yes. ANSSI’s evaluation guidance states that any end product “that includes post-quantum mitigation shall implement hybridation,” and the only exception is a product whose quantum mitigation rests solely on hash-based signatures such as XMSS, LMS, or SPHINCS+, where hybridation is optional. That carve-out exists because hash-based schemes rest on assumptions the cryptographic community has studied for far longer than lattices.

Platform products get a narrower path. A component that supplies raw cryptographic functions to an application layer above it can be evaluated without hybridation, since the hybrid construction will live in that upper layer, but ANSSI still requires a hybridation mode implemented for test purposes and a line in the user documentation telling integrators to use the post-quantum algorithm only in combination with a recognized classical one.

ANSSI structures the whole transition as three phases rather than a single cutover:

1. Phase 1, now: “hybridation to provide some additional post-quantum defense-in-depth to the pre-quantum security assurance.” Pre-quantum security is mandatory, post-quantum is optional, and no quantum resistance is claimed.
2. Phase 2, “not earlier than 2025”: “hybridation to provide post-quantum security assurance while avoiding any pre-quantum security regression.” Post-quantum public-key algorithms “shall continue to be systematically included inside hybrid mechanisms,” with the hash-based exception carried forward. Planned to last until at least 2030.
3. Phase 3, “probably not earlier than 2030”: “optional standalone post-quantum cryptography,” once ANSSI judges post-quantum assurance to be as high as today’s pre-quantum assurance.

One sentence in the phase-2 description carries more weight than its placement suggests. ANSSI says it will set its own criteria for acceptable post-quantum algorithms, and that “such selected algorithms may not exactly match NIST standards.” That’s a sovereignty position written as a technical aside, and it means the French list and the NIST list are not guaranteed to converge.

Source: ANSSI, “ANSSI views on the Post-Quantum Cryptography transition,” March 30, 2022 position paper (the three-phase roadmap and the “such selected algorithms may not exactly match NIST standards” criterion), PDF; and “(2023 follow up),” December 21, 2023, which restates the roadmap by reference, PDF.

Does BSI require hybrid cryptography?

Germany recommends it rather than mandating it, and the recommendation is specific about when it applies: quantum-safe key agreement should be deployed in hybrid mode with a classical mechanism for anything requiring long-term protection. TR-02102-1 names the reason directly, framing it as a “Store Now, Decrypt Later” problem, which is the same threat this guide covers under harvest-now-decrypt-later.

BSI also does two things the other three authorities don’t. It keeps conservative alternatives on the recommended list, retaining FrodoKEM (unstructured lattices) and Classic McEliece (code-based) alongside ML-KEM, which hedges the family risk rather than only the algorithm risk. And its classical baseline is stricter than the American one, recommending 3000-bit RSA where US guidance has long settled on 2048.

For TLS specifically, BSI has stated an intention rather than a live rule. It intends to recommend the hybrid groups SecP256r1MLKEM768 and SecP384r1MLKEM1024 once the corresponding IETF draft becomes an RFC, which means the German hybrid TLS pairing is elliptic-curve P-256 and P-384 with ML-KEM, and not the X25519 pairing that dominates elsewhere.

Source: BSI, TR-02102-1 Version 2026-01, PDF, §1, §2.2, §5.3.4; TR-02102-2 Version 2026-01, PDF, Table 10 note; IETF, RFC 10024, “Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3,” Standards Track, August 2026 (formerly draft-ietf-tls-ecdhe-mlkem), datatracker.ietf.org.

Does the NCSC recommend hybrid cryptography?

The UK’s position is the one most often misread, because it neither bans hybrid nor endorses it as a destination. The NCSC’s stated recommendation is that “if a PQ/T hybrid scheme is chosen, the NCSC recommends it is used as an interim measure, and it should be used within a flexible framework that enables a straightforward migration to PQC-only in the future.”

The reasoning behind it is worth following, because it’s the strongest argument against the French and German position. Once a cryptographically relevant quantum computer exists, the traditional half of a hybrid scheme provides no additional protection at all, so from that point forward the hybrid construction is carrying implementation complexity, larger messages, and more code paths in exchange for nothing. A permanent hybrid deployment is therefore a permanent cost with an expiry date on its benefit.

The NCSC does name three circumstances where hybrid earns its place during the transition:

1. Interoperability, while a network migrates in phases and both old and new endpoints have to talk to each other.
2. Implementation security, while assurance in new post-quantum implementations is still developing.
3. Protocol constraints, for example avoiding IP fragmentation in IKEv2.

Its parameter picks are also lighter than the American ones: ML-KEM-768 and ML-DSA-65 for general-purpose use, with all parameter sets treated as acceptable for personal, enterprise, and OFFICIAL-tier government information.

The separate 2025 timelines guidance sets the UK migration clock at three milestones: define goals and complete discovery by 2028, execute the highest-priority migration work by 2031, and finish across all systems, services, and products by 2035. That document doesn’t restate or withdraw the hybrid position, so the 2024 whitepaper remains where the UK’s hybrid stance lives.

Source: NCSC, “Next steps in preparing for post-quantum cryptography,” Version 2.0, August 14, 2024, whitepaper; “Timelines for migration to post-quantum cryptography,” March 20, 2025, guidance.

Does CNSA 2.0 allow hybrid cryptography?

It allows it and refuses to let it change anything. Even where a hybrid deployment is permitted or required for interoperability, CNSA 2.0 becomes mandatory to select at each published date, and choosing a CNSA 1.0 algorithm on its own stops being approved at that point. Hybrid keeps a system interoperable, and it doesn’t extend a deadline by a single day.

That posture follows from where the NSA puts its emphasis. Instead of arguing about construction, CNSA 2.0 leans on two other levers: the calendar, with new National Security Systems acquisitions required to support CNSA 2.0 from January 1, 2027, non-supporting equipment replaced by December 31, 2030, and full mandate by December 31, 2031; and parameter strength, requiring NIST security level 5 across the board with ML-KEM-1024 and ML-DSA-87 at every classification level, where NIST’s general-purpose recommendation is ML-KEM-768.

Source: NSA, “CNSA 2.0 FAQ,” PP-24-4014, December 2024 update, PDF.

Why do the four authorities disagree?

Each one is hedging a different failure mode, and each hedge is rational given the failure the agency is most worried about.

France and Germany are hedging algorithm risk, with precedent behind them. ANSSI’s own words are that post-quantum algorithms “are still not mature enough to solely ensure the security,” and it points at history rather than speculation: “several post-quantum schemes have suffered from classical attacks in the past years.” That’s a reference to real casualties of the NIST process, where candidate schemes were broken by classical mathematics after years of public scrutiny. If it happened to those, the argument runs, it can happen to a survivor, and a hybrid construction means such a break costs you nothing.

The UK is hedging complexity risk. Every additional code path is somewhere a bug can live, every larger message is a place a protocol can break, and the classical half of a hybrid scheme stops contributing security the day a quantum computer arrives. Building hybrid as a permanent architecture means committing to that cost forever, so the NCSC’s answer is to treat it as scaffolding and take it down when the building stands on its own.

The US is hedging schedule risk. National Security Systems have long procurement cycles and equipment that stays in service for decades, so the binding problem is getting the fleet moved at all before the threat lands. Arguing about hybrid would introduce an optional path, and an optional path is a place a program slips. Fixed dates and maximum parameters remove the negotiation.

The alignment isn’t coincidental either. ANSSI states in its follow-up paper that “this position is aligned with the one of other European cybersecurity agencies like BSI in Germany,” and notes that BSI “has even re-stated the need for hybridation in their recent updated technical guideline.” France and Germany are a deliberate bloc, which is why the split is 2 + 1 + 1 rather than a genuine four-way disagreement.

Source: ANSSI, “(2023 follow up),” December 21, 2023, PDF; NCSC, “Next steps in preparing for post-quantum cryptography,” whitepaper.

Where do all four authorities agree?

The disagreement is narrower than it looks, and four things are settled across every one of these documents.

1. The NIST algorithms are the algorithms. ML-KEM for key establishment and ML-DSA for signatures appear in all four positions, with hash-based schemes reserved for specialized cases such as firmware signing. Nobody is proposing a rival family.
2. Symmetric cryptography is a sizing question, not a replacement question. Grover’s algorithm reduces effective symmetric strength, so the answer is larger parameters rather than new primitives. ANSSI is the most conservative here, asking for AES-256-equivalent block ciphers and SHA2-384-equivalent hashes, which it acknowledges is stricter than both NIST and BSI.
3. Long-lived data drives urgency. Harvest-now-decrypt-later appears as an explicit motivation in the French, German, and British documents, and it’s the reason all three tie obligations to how long data must stay confidential.
4. Crypto-agility is the durable requirement. Every authority wants systems that can change algorithms without re-architecture, and the NCSC states it plainly, advising organizations to “seek solutions that offer cryptographic agility.” See Crypto-Agility.

What happens to a product sold in more than one of these jurisdictions?

The four positions stack rather than cancel, and the strictest requirement in each dimension is the one a multi-jurisdiction product ends up meeting.

A product seeking a French security visa has to implement hybridation. A product sold to US National Security Systems has to reach ML-KEM-1024 and ML-DSA-87 by the CNSA dates. A product following German guidance runs the P-256 and P-384 hybrid TLS pairings rather than the X25519 pairing common elsewhere. A product built to UK guidance has to keep a clean path to PQC-only available, which rules out hardwiring the hybrid construction so deeply that removing the classical half means rebuilding.

Those four demands are satisfiable together, and the combination is more work than any single one of them. A vendor selling across all four markets converges on hybrid, at level-5 parameters, with the classical half separable, which is not what any one authority asked for by itself.

Common misconceptions

• “The EU requires hybrid and the US bans it.” Neither half is right. France requires it for certification, Germany recommends it, and the US permits it while refusing to let it move a deadline. No authority in this set prohibits hybrid.
• “Hybrid buys more time.” CNSA 2.0 closes this explicitly. At each mandatory date, selecting a CNSA 1.0 algorithm alone stops being approved, hybrid deployment or not.
• “The NCSC is against hybrid.” The NCSC names three circumstances that warrant it and objects only to treating it as a permanent end state rather than as an interim measure.
• “ANSSI’s hybrid rule is only a recommendation.” For products going through French security-visa evaluation, the wording is that a product “shall implement hybridation.” Advice and certification requirements are different instruments.
• “Hybrid always applies to signatures too.” ANSSI applies it to signatures with one exception, exempting mitigations that rely solely on hash-based schemes such as XMSS, LMS, and SPHINCS+.
• “All four will converge on the NIST list.” ANSSI reserves the right to diverge, stating that its selected algorithms “may not exactly match NIST standards.”

Questions people ask

Does France legally require hybrid cryptography? For products going through ANSSI’s security-visa evaluation, yes: the guidance states an end product with post-quantum mitigation “shall implement hybridation.” Outside that certification process the position is a strong recommendation rather than a legal obligation, and it applies most firmly to products protecting information beyond 2030.

Which authority is strictest overall? It depends on the dimension. ANSSI is strictest on requiring hybrid and on symmetric sizing, BSI is strictest on classical key sizes at RSA-3000, and the NSA is strictest on parameter strength with level 5 everywhere and on deadlines.

If the UK thinks hybrid is temporary and France thinks it’s required, who is right? Both, about different risks. France is protecting against a post-quantum algorithm being broken, and the UK is protecting against carrying permanent complexity that stops providing security once a quantum computer exists. Neither agency disputes the other’s facts.

Do I have to pick one position? A product sold into several of these markets generally ends up meeting the strictest requirement in each dimension rather than choosing a single national line, which in practice means hybrid, at high parameters, built so the classical half can be removed later.

Why does BSI recommend algorithms nobody else emphasizes? FrodoKEM rests on unstructured lattices and Classic McEliece is code-based, so keeping them on the list hedges against a break in the structured-lattice family that ML-KEM belongs to. It’s a hedge against a whole mathematical family rather than against a single algorithm.

Has the UK changed its hybrid position since 2024? Not in any published document reviewed here. The March 2025 timelines guidance sets the 2028, 2031, and 2035 milestones and doesn’t restate or withdraw the hybrid position, so the August 2024 whitepaper remains the source for it.

What did ANSSI mean by saying its algorithms may not match NIST’s? ANSSI says it will define its own criteria for acceptable post-quantum algorithms in phase 2 and that the resulting selection “may not exactly match NIST standards.” It reserves French cryptographic sovereignty rather than adopting the American list by default.

When does hybrid end? France has the only dated answer, putting standalone post-quantum use in phase 3, “probably not earlier than 2030.” The UK ends it whenever a clean migration to PQC-only becomes available, Germany hasn’t dated it, and for CNSA 2.0 the question doesn’t arise because hybrid was never the mechanism carrying the schedule.

The map is free and I keep it that way. When the disagreement between these four authorities lands on an actual architecture decision inside your organization, that’s the work I do at LaMarr Labs.

Go deeper

• Hybrid Cryptography for how the construction actually works
• ANSSI Cryptographic Mechanisms, BSI, UK NCSC Quantum-safe Cryptography, and NSA CNSA 2.0 for each authority in full
• The Mandates MOC for the whole regulatory picture
• Crypto-Agility for the requirement all four share

Last verified 2026-08-02 · Maintained by Addie LaMarr, LaMarr Labs.