NIST 800-131A Standard Summary

Read through the NIST 800-131A document and have tried to summarise the standard here. I have excluded all time limited options for this and mention here only the standards that are deemed always acceptable.

Encryption

Triple DES Encryption is being deprecated and only 3 key triple DES is now acceptable. SKIPJACK encryption is no longer acceptable. AES Encryption has 3 approved key lengths: 128, 192 and 256.
From the following Rijndael AES differences link it seems that the AES encryption algorithm is a form of the Rijndael algorithm except that it has a fixed block size. Essentially, if you want to use Rijndael as AES you need to make sure that:

• The block size is set to 128 bits
• You are not using CFB mode, or if you are, the feedback size is also 128 bits

Digital Signatures

There are three digital signature algorithmns approved: DSA, ECDSA and RSA. It seems that for RSA that this equates to a key size of at least 2048 bits.

Random Number Generators

The following are listed as the standards currently acceptable as specified in the SP 800-90 document: HASH, HMAC, CTR, DUAL_EC.

Digital Signatures

Basically this section says that the key length must be of at least 112 bits.

Hash Functions

SHA1 is no longer acceptable for digital signature generation HOWEVER, for “… hash-only applications (e.g., hashing passwords and using SHA-1 to compute a checksum…”, it is still acceptable (see page 14, end of section 9). SHA-224/256/384/512 are all deemed acceptable for all hashing function applications.

Message Authentication Codes

HMAC based hashing functions are always acceptable when the key size is at least 112 bits