@@ -3284,6 +3284,22 @@ A cryptographic algorithm, scheme or protocol that is not CRY-SOTA under items i
iv) Interoperability-based: it is required for a specific product function to comply with a well-defined external specification or external requirement, and its use meets all of the conditions for legacy interoperability set out in clause K.2.4 (2). Inclusion of a cryptographic algorithm, scheme or protocol under this route does not classify it as CRY-SOTA.
- NOTE 1: Items i), ii) and iii) are listed as alternatives for classification as CRY-SOTA. A manufacturer is not required to demonstrate classification under more than one of these items for the same algorithm. Item iv) is not a CRY-SOTA classification; it admits a non-CRY-SOTA algorithm under controlled interoperability conditions.
- NOTE 2: Where two recognized catalogues classify the same algorithm differently, the manufacturer should rely on whichever produces the more conservative (less permissive) classification.
- NOTE 3: A cryptographic mechanism composed of more than one cryptographic primitive (for example a hybrid key-encapsulation mechanism or a hybrid signature scheme) inherits the most restrictive classification of its constituent primitives. A hybrid construction including a Legacy or Deprecated component is therefore classified as Legacy or Deprecated, regardless of the classification of the other components.
