CNSA2KeyAgreementEnabled

Enables the CNSA 2.0 ML-KEM-1024 key agreement for TLS.

ML-KEM-1024 is the highest-strength parameter of the post-quantum key encapsulation mechanism specified in FIPS 203, and the algorithm required by version 2.0 of the Commercial National Security Algorithm Suite (CNSA). When the policy is set to true, Firefox offers the ML-KEM-1024 key agreement group during the TLS handshake. ML-KEM-1024 is not offered by default.

Setting this policy locks the preference, whether the value is true or false, so users cannot change it.

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 154	Not supportedNo	Available since 154

CCK2 Equivalent: N/A
Preferences Affected: security.tls.enable_mlkem1024

Examples

policies.json

{
  "policies": {
    "CNSA2KeyAgreementEnabled": true
  }
}

JSON schema

CNSA2KeyAgreementEnabled JSON schema

{
  "type": "boolean"
}

Windows (GPO)

Software\Policies\Mozilla\Firefox\CNSA2KeyAgreementEnabled = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CNSA2KeyAgreementEnabled

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>CNSA2KeyAgreementEnabled</key>
  <true/> | <false/>
</dict>

See also

• PostQuantumKeyAgreementEnabled policy, which controls the ML-KEM-768 key agreement offered to general web traffic.
• NIST FIPS 203, 204, and 205 Finalized: An Important Step Towards a Quantum-Safe Future on cloudsecurityalliance.org (2024)