Draft Version 3 of the EUCC Agreed Cryptographic Mechanisms
On June 2, 2026, ENISA, the European Union Agency for Cybersecurity, published the draft of version 3 of the “Agreed Cryptographic Mechanisms” for public consultation. This guideline sets out which cryptographic mechanisms are accepted in products certified under the EUCC scheme. The new draft shifts these rules noticeably toward post-quantum cryptography (PQC).
Contents
What are the Agreed Cryptographic Mechanisms?
The Agreed Cryptographic Mechanisms (ACM) are a guideline of the cryptography subgroup of the European Cybersecurity Certification Group (ECCG). They state which cryptographic mechanisms the national certification authorities accept. The ACM addresses developers and evaluators and classifies each mechanism as “recommended” or “admissible,” including key lengths and validity periods.
The document is part of the European Common Criteria-based cybersecurity certification scheme (EUCC) and is revised every two years. Version 2 was adopted in mid-2025. The draft of version 3 is the first major update since then.
What happened?
ENISA published the draft together with a changelog. All changes compared to version 2 are marked in red in the document, which makes comparison easier. The public consultation ran until the end of July 2026; feedback could be submitted through an online survey of the European Commission.
The draft contains twelve changes, from purely editorial updates to structural changes to the category model. Most of the substantive changes revolve around one topic: preparing for the quantum threat.
What changes in detail?
The twelve changes fall into a few main areas. The focus is on the status of post-quantum mechanisms, the revised category model, and several newly added mechanisms.
Post-quantum mechanisms become recommended
The most important change concerns the status of post-quantum mechanisms. Several of them receive the highest status, “recommended,” in the draft:
- ML-KEM (FIPS 203) and FrodoKEM for key establishment
- ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures
- the stateful hash-based signatures XMSS and LMS (SP 800-208)
This puts the standardized PQC mechanisms on the same level as established classical mechanisms for the first time. In return, classical asymmetric mechanisms such as RSA, FF-DLOG, and EC-DLOG are consistently listed as “admissible”: still allowed, but no longer the first choice for new systems.
Hybridization becomes more specific
The draft keeps the recommendation to use PQC mechanisms not on their own but in hybrid mode together with a classically secure mechanism. What is new is that the guideline describes this much more precisely and names specific key combiners (NIST SP 800-227, CatKDF, CasKDF). The reason is the state of standardization, which has moved forward for hybrid schemes.
TLS shows this too. The draft adds hybrid TLS 1.3 cipher suites such as X25519MLKEM768 and SecP256r1MLKEM768 and classifies them as recommended. They combine a classical key exchange with ML-KEM, so an attacker would have to break both parts to compromise the connection.
New category model: from legacy to admissible
The most significant structural change is the revision of the categories. The previous label “legacy” is dropped and replaced by “admissible.” Recommended mechanisms offer at least 125 bits of security and reflect the state of the art. Admissible mechanisms offer at least 100 bits, are considered acceptable in the short term, and should be replaced where possible.
The draft also adds a notation for a minimum validity. A[2033] means that acceptance ends on December 31, 2033. A[2033+] means that the mechanism remains admissible at least until then and that the deadline may be extended in future versions. The default value for admissible mechanisms is A[2033+]. The quantum threat drives this refinement: it does not exist in practice yet, but you already have to consider it when choosing mechanisms.
New mechanisms
Beyond the PQC mechanisms, the draft adds further mechanisms. EdDSA (RFC 8032) is added as an elliptic curve signature scheme, with a note on the deterministic generation of the signature value and the resulting susceptibility to fault attacks. For password hashing, Argon2id (RFC 9106) is added as a recommended mechanism; PBKDF2 remains admissible. As a memory-hard function, Argon2 offers better guarantees against password guessing than purely iteration-based methods. The draft also introduces extendable-output functions (XOF) such as SHAKE and cSHAKE as a separate category, because ML-KEM and ML-DSA already use them.
AES clarification and removals
For AES, the draft explicitly states that doubling the key length is not necessary: AES-128 remains admissible in all contexts, including in a PQC setting. Where quantum resistance is required, however, AES with at least 192 bits is recommended. At the same time, the draft removes mechanisms that had already been deprecated in several places, because there is no longer any reason to keep them in the guideline.
A defined update process
Finally, a new Annex C defines for the first time a formal process for updating the ACM and for external parties to submit proposals. This is why the consultation was open in a structured way in the first place.
What this means for manufacturers
The ACM applies directly to products certified under the EUCC scheme. Take a secure element or a hardware security module as an example. If you have it certified under the EUCC, you must check the cryptographic mechanisms it uses against the accepted list. The recommended or admissible status and the related deadlines help determine how long a product remains accepted on the market.
The direction of travel matters most for long-lived industrial products. A machine controller with remote maintenance over TLS often stays in the field for ten years or longer. Over that time span, the “harvest now, decrypt later” scenario applies. Communication that is intercepted today and protected with classical encryption can be decrypted later, once a powerful quantum computer is available. The upgrade of PQC mechanisms and the emphasis on hybrid mode target exactly this type of product.
The ACM also sets the direction outside direct EUCC certification. The cryptographic requirements of the RED Delegated Act and EN 18031, and the expectations for secure product development in the CRA conformity assessment, move in the same direction. If you align your cryptography strategy with recommended mechanisms and plan for PQC in hybrid mode, your decision will hold beyond the EUCC scheme.
The consultation on the draft ended at the end of July 2026. The draft may still change until it is adopted; until then, version 2 remains applicable. For strategic planning, the final wording of individual tables matters less than the clear direction: away from purely classical asymmetric cryptography and toward hybrid and post-quantum mechanisms.
The upgrade of post-quantum mechanisms and the new category model provide orientation, but they raise concrete migration questions for existing product portfolios.
Cryptography is part of your product compliance
EUCC, CRA, or EN 18031: requirements for cryptography run through almost every product regulation. Secuvise supports manufacturers from interpreting the requirements to implementing them in the product. If the topic becomes relevant for your products, get in touch.
