CNSA2KeyAgreementEnabled

Enables the CNSA 2.0 ML-KEM-1024 key agreement for TLS.

ML-KEM-1024 is the highest-strength parameter of the post-quantum key encapsulation mechanism specified in FIPS 203, and the algorithm required by version 2.0 of the Commercial National Security Algorithm Suite (CNSA). When the policy is set to true, Firefox offers the ML-KEM-1024 key agreement group during the TLS handshake. ML-KEM-1024 is not offered by default.

Setting this policy locks the preference, whether the value is true or false, so users cannot change it.

Values

Set to true to enable ML-KEM-1024 key agreement, and prevent the user from changing it.
Set to false to disable ML-KEM-1024 key agreement, and prevent the user from changing it.

Examples

{
  "policies": {
    "CNSA2KeyAgreementEnabled": true
  }
}

JSON schema

{
  "type": "boolean"
}

Windows (GPO)

Software\Policies\Mozilla\Firefox\CNSA2KeyAgreementEnabled = 0x1 | 0x0

macOS

<dict>
  <key>CNSA2KeyAgreementEnabled</key>
  <true/> | <false/>
</dict>

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 154	Not supported	Available since 154

CCK2 Equivalent: N/A
OMA-URI: CNSA2KeyAgreementEnabled
Preferences Affected: security.tls.enable_mlkem1024