FCIA’s FC-SP-3: A Standard Ready for the Quantum-Computing World

extract

In enterprise IT, most security upgrades typically occur in response to breaches or other significant incidents. The recently developed INCITS FC-SP-3 standard, however, represents a proactive response to regulatory and cryptographic deadlines that are already influencing infrastructure planning. The NSA’s CNSA 2.0 guidance presents National Security Systems with a complex migration path, while the European Union’s NIS2 and DORA frameworks have incorporated cryptography and encryption policies into active compliance programs. The quantum computing timeline intensifies this pressure, not due to a predictable arrival of a cryptanalytically relevant quantum computer, but because “harvest now, decrypt later” attacks render long-lived data vulnerable in advance. The FCIA (Fibre Channel Industry Association) roadmap contextualizes these challenges around 2030 compliance, NIS2 and DORA encryption policies, and the standard three-to-five-year replacement cycle for servers and storage. The timing is critical because Fibre Channel transports data that enterprises can least afford to lose. It continues to serve as the primary infrastructure for mission-critical storage in sectors such as finance, healthcare, government, utilities, and other regulated industries. Fibre Channel is both physically and logically isolated from Ethernet, is not routable from Ethernet networks, and is further secured through fabric zoning and storage-device masking. FCIA market data indicates that over 160 million Fibre Channel ports have been shipped, with more than 35 million still operational. This substantial installed base underscores the significance of FC-SP-3, which does not require enterprises to replace their SANs but instead provides a standards-based approach to securing existing Fibre Channel environments. FC-SP-3 delivers several updates that improve security posture and simplify deployment. It removes obsolete cryptography that earlier versions still carried, including 3DES, MD5, SHA-1, RSA-SHA-1, older DH-CHAP groups, RADIUS usage, CT authentication, and smaller AES key lengths for AES-GCM and AES-CBC. In their place come CNSA 2.0-aligned additions, including ML-KEM-1024 for key establishment and ML-DSA-87 for digital signatures, along with stronger SHA-2 PRFs and the required use of AES-GCM for security association management. The other major change is structural: FC-SP-3 moves away from FC-SP-2’s compliance elements and toward interoperability profiles, so implementations can align around current security requirements without dragging forward obsolete-but-compliant requirements. As part of that cleanup, the specification was reduced by nearly half, from 288 pages to 152. It is important to note that FC-SP-3 alone does not eliminate exposure risk; it serves as a toolset rather than an automatic deployment. The standard is significant because it provides the industry with a practical pathway toward authenticated, encrypted, and integrity-protected SAN traffic, integrated into the regular server, HBA, and storage refresh cycles. For enterprises managing long-lived data and regulated infrastructure, the critical deadline is not limited to Q-Day or 2030, but rather the next refresh decision. The following sections examine the regulations driving these changes, the cryptographic updates introduced by FC-SP-3, and the practical model for implementing end-to-end encryption on an operational Fibre Channel fabric. Key Takeaways - The standard beat the deadlines: FC-SP-3, completed by INCITS T11 in 2026, modernizes Fibre Channel security to meet CNSA 2.0, NIS2, and DORA requirements years ahead of the 2030 and 2031 compliance dates. - Subtraction first, then quantum resistance: Legacy cryptography such as 3DES, MD5, SHA-1, and sub-2048-bit DH groups is removed, while the NIST post-quantum algorithms ML-KEM-1024 and ML-DSA-87 are added, cutting the specification from 288 pages to 152 and making it easier to implement correctly. - Encryption without the infrastructure tax: Autonomous in-flight encryption generates keys inside the HBA and runs at line rate, with no external key server, no SAN switch changes, and no added host CPU load. - The array keeps its superpowers: Encrypting at the transport layer preserves the compression, deduplication, and ransomware detection that application-level encryption defeats. - Compliance rides the refresh cycle: A rolling deployment on the normal three-to-five-year hardware refresh delivers a fully encrypted, quantum-resistant SAN by 2030 as a byproduct of routine procurement. Encryption Is on a Deadline The development of FC-SP-3 is primarily motivated by the increasing need for advanced security measures throughout the datacenter technology stack. Traditional architectures often rely on implicit trust within storage networks; however, sophisticated attacks at this layer can compromise significant volumes of data. Supply chain attacks, exemplified by the 2019-2021 SolarWinds malware campaign, have demonstrated that insider threats exploiting compromised infrastructure components are becoming more prevalent. In a direct response, US President Joseph Biden issued Executive Order 14028 on May 12, 2021. This order established a multitude of new security requirements and operating procedures for systems used by the federal government (also known as National Security Systems). By requiring encryption for data at rest and in transit, it effectively forced federal agencies to adopt the principles of the original Commercial National Security Algorithm (CNSA) Suite, which outlined cryptographic algorithms approved for protecting federal data. Although the CNSA Suite (often referred to as CNSA 1.0) did not address or anticipate future capabilities, it established a baseline of acceptable algorithms for data protection, key establishment, hashing, and digital signing. CNSA 2.0 advances the goals of the suite by preparing the federal government’s information security standards for the advent of quantum computing. It retires algorithms theorized to be easily broken by quantum computers and introduces quantum-resistant ones. The NSA has designed the policy to be implemented in stages, with the first phase of enforcement beginning after December 31, 2025. By January 1, 2027, new installations of National Security Systems will be required to be fully CNSA 2.0 compliant, and decommissioning of non-compliant systems must be completed by December 31, 2030. Finally, all National Security Systems will be required to use CNSA 2.0 algorithms exclusively by December 31, 2031. The deadlines are tight for such a massive network, but the threat of a quantum-computing-enabled breach makes it necessary in the eyes of the United States federal government. The USA is not the only country that requires stronger security measures for critical IT systems. The Digital Operational Resilience Act (DORA), which applies to financial institutions in the European Union, requires strict reporting, risk management, and security testing procedures to better prepare those services for future cyberattacks. Similarly, the Network and Information Security 2 (NIS2) directive encourages the sharing of cybersecurity threat information among EU members. It requires each country to develop and adopt strategies to combat supply chain attacks and vulnerability exploitation. Since many of these regulations require strong in-flight and at-rest data encryption, FC-SP-3 furthers their shared goal of making core infrastructure resilient to attacks at every layer. Q-Day and Harvest Now, Decrypt Later While CNSA 2.0 appears to be a tall order, it is not without reason. “Harvest now, decrypt later” (HNDL) is a strategy currently employed by malicious actors that relies on the future capabilities of quantum computers to decrypt mountains of intercepted communications and stolen data. While many of today’s standard cryptographic algorithms and protocols are highly resistant to brute-force attacks and other key-cracking methods on conventional hardware, the creation of a “Cryptanalytically Relevant Quantum Computer” (CRQC) could break public-key encryption methods that rely on RSA and ECC (Elliptic Curve Cryptography). In an effort to reduce the effectiveness of a potential Q-Day attack, the NSA has mandated that all cryptographic-related components of the USA’s National Security System must be CNSA 2.0 compliant by December 31, 2031, ahead of industry projections that put Q-Day as early as 2033. The cryptographic algorithms mandated in CNSA 2.0 are “Post-Quantum Computing” ready, meaning they are designed with mathematical problems that are computationally intractable, such as lattice problems and one-way number-theoretic problems. By using larger key sizes on traditional algorithms and implementing sophisticated PQC-ready algorithms, the NSA intends to prevent HNDL attacks that could compromise national security. Two Decades of Fibre Channel Security Fibre Channel security did not begin with FC-SP-3. The standard is the third generation of work that has been underway at INCITS (InterNational Committee for Information Technology Standards) for more than twenty years, under the Fibre Channel Technical Committee known as T11. The original FC-SP project was approved in 2002 and published in 2007, establishing authorization and segmentation controls that gave storage administrators formal tools to determine which devices could see one another across a fabric. FC-SP-2 was adopted in 2012, extending the framework to authentication and encryption, and it has continued to evolve through two amendments, AM1 in 2015 and AM2 in 2023. FC-SP-3 was approved as a project in 2022 and completed in 2026, updating the framework for the regulatory and post-quantum requirements now bearing down on storage networks. That lineage matters because it frames what FC-SP-3 is and is not. This is not a reinvention of Fibre Channel security or a bolt-on response to a single threat. It is the scheduled modernization of a mature framework, done openly by the people who build this equipment. The FC-SP-3 expert group was chaired by Roger Hathorn of IBM and edited by David Peterson and James Smart of Broadcom, with contributors from Broadcom, Cisco, Dell, HPE, IBM, Marvell, NetApp, and Viavi. That breadth is worth noting in a security standard: the companies that compete for every SAN socket agreed on how encryption across those sockets should work. Nor does the work stop here. T11 has already begun development on the next revision, so the framework will keep pace as requirements continue to evolve. What FC-SP-3 Changes The headline change in FC-SP-3 is subtraction. Following the same direction TLS 1.3 took for the web, the standard removes the legacy cryptography that FC-SP-2 still carried: the FC-PAP and FC-EAP authentication protocols, 3DES and AES-CTR encryption, RSA-SHA-1 signatures, MD5 and SHA-1 in nearly every role, DH-CHAP groups below 2048 bits, AES key lengths under 256 bits for GCM and CBC modes, RADIUS usage, and CT authentication. Removing obsolete material and reorganizing the document cut the specification from 288 pages to 152. A shorter standard is not just easier to read; it is easier to implement correctly, and it leaves fewer weak options for an implementation to fall back on. In their place come the CNSA 2.0-aligned additions: ML-KEM-1024 for key establishment and ML-DSA-87 for digital signatures, the NIST-standardized post-quantum algorithms, alongside ECDSA at 384 and 512 bits, SHA-2-based PRFs, and a requirement that AES-GCM protect the security association management protocol itself. Hiding the encryption method used to protect the payload provides a layer of obscurity, forcing potential attackers to account for a large range of algorithms (which could be quite computationally expensive). Quantum-safe key encapsulation algorithms like ML-KEM effectively counter interception attacks, ensuring that only authenticated and authorized devices can read data sent by an HBA using the latest security protocols. The structural change is just as consequential. FC-SP-2 defined tiered compliance elements, and the lowest common tier, Auth-A, required implementations to support MD5 and a 2048-bit DH group. As those algorithms aged, vendors ended up in the strange position of implementing insecure cryptography they never intended to use, purely to remain compliant with the standard. FC-SP-3 abandons that model in favor of interoperability profiles, defined in Annex A. A compliant implementation supports one or more profiles that match the security requirements of its target environment, and judgments about which requirements apply are left where they belong, with bodies like NIST and the NSA rather than the transport standard itself. Backward compatibility with FC-SP-2 deployments is addressed in Annex D, so mixed fabrics have a documented path rather than a cliff. Audit Mode facilitates the transition to the updated cryptographic standard by enabling security protocol negotiation across existing fabrics without causing data access disruption. The standard’s authors recognize that many SANs will not achieve full compliance immediately, but will incrementally adopt the standard as newer hardware is introduced and legacy equipment is retired. In Audit Mode, compatibility is maintained through an availability-first approach, allowing the most stringent security measures to be implemented only when both endpoints in a connection are fully capable. That is, access to mission-critical data is preserved while the migration to stronger security takes place. Putting FC-SP-3 on a Live SAN A standard only matters once it reaches production hardware, and FC-SP-3 was written with deployment in mind. The specification defines the cryptographic tools and the negotiation behavior; how those tools get applied on a running fabric comes down to two broadly available models. Both are vendor-neutral and compliant with the same standard. The first is the key server model, long familiar to mainframe and high-compliance environments. An external key manager provisions and rotates the shared secrets or certificates used to establish secure sessions, communicating with hosts and storage over the network through the Key Management Interoperability Protocol (KMIP) and a security key exchange. This approach centralizes policy and auditing, which is exactly what some regulated shops want. It also introduces infrastructure to stand up and maintain: a key management server, network paths to it, and the operational discipline to keep it available. For organizations that already run KMIP infrastructure, FC-SP-3 slots into an established workflow rather than replacing it. The second model is autonomous in-flight encryption handled inside the host bus adapter, and it is the one that makes a fabric-wide rollout realistic. Random session keys are generated within the HBA itself, eliminating the need for an external key generation and management server. Endpoints are enabled by default and negotiate encryption automatically, falling back when a peer does not yet support it so that the fabric can be secured without a flag day. Because encryption happens at the Fibre Channel transport layer inside the adapter, no changes are required to SAN switches, and the switch fabric neither sees nor manages keys. Performance is the objective this model is meant to address. Encryption runs in dedicated silicon at full line rate, so there is no measurable throughput penalty and no additional load placed on host CPUs. Just as important for storage teams, encrypting in flight rather than at the application layer preserves the array services enterprises depend on. Data reaching the storage array can still be compressed, deduplicated, and scanned for compression-ratio anomalies that flag a ransomware event, none of which is possible once the application has encrypted the data before it leaves the host. In-flight encryption is not meant to stand alone. FC-SP-3 fits into a defense-in-depth posture, where link encryption is combined with full-disk or array-level encryption at rest to protect data both in transit across the SAN and at rest on media. The endpoints anchoring that posture are designed as zero-trust components in their own right. A silicon root of trust establishes hardware identity, the CPU and HBA attest to one another using the Security Protocol and Data Model (SPDM), and drivers are cryptographically signed. The adapter enforcing encryption can therefore be verified rather than trusted. The feature that most directly addresses the fear of touching a production SAN is Audit Mode, new in FC-SP-3. It lets administrators enable security negotiation across an existing environment and see which links would be encrypted and which would not before enforcement is switched on. That turns a potentially disruptive cutover into an incremental, verifiable process, and it is the practical mechanism behind the rolling deployment the FCIA roadmap envisions: secure links as servers and storage refresh, rather than in a single coordinated event. Autonomous in-flight encryption is already shipping in FC-SP-3 capable HBAs, and StorageReview covered the first of them when the technology was introduced. It is a useful proof point that the standard is deployable today. Still, the more important takeaway is architectural rather than brand-specific: any FC-SP-3 compliant endpoint can participate, and every major server vendor already ships Fibre Channel connectivity capable of autonomous in-flight encryption, with most storage OEMs adding it through 2026. What In-Flight Encryption Protects Against The case for encrypting storage traffic becomes much easier to make once the attack vectors are named. Fibre Channel links routinely leave the room where they originate, crossing conduits, risers, and campus runs between buildings. An attacker with physical access to that fiber does not need to cut it. And while very rare, bending a cable enough to leak light or inserting a passive splitter is sufficient to read the traffic passing through it, and nothing about the link tells an administrator that it happened. The threats inside the building are less cinematic and more common. An insider with access to a patch panel can record traffic without ever disturbing the link, and diagnostic devices can capture frames into service logs, exposing data to anyone with access to those logs. In-flight encryption closes all of these paths at once. Traffic captured anywhere between two FC-SP-3 endpoints, whether from a bent fiber, a patch panel, or a log file, is ciphertext with no key available at the point of capture. The subtler benefit is what in-flight encryption preserves. Ransomware encrypts data as it attacks, and encrypted data does not compress, so a shift in compression ratios at the array is one of the more reliable early indicators of an infection in progress. If applications encrypt data before it leaves the host, the array always sees ciphertext: compression and deduplication stop working, and the ransomware signal disappears along with them. Encrypting at the transport layer protects data in transit while delivering it to the array in a usable form, preserving data reduction and anomaly detection. This is why FCIA guidance favors in-flight encryption combined with encryption at rest over application-level encryption. The Road to a Fully Encrypted SAN The math behind the FCIA roadmap is refresh-cycle math. Servers and storage turn over every three to five years in most shops, which means nearly every fabric will replace its endpoints at least once before the 2030 and 2031 CNSA 2.0 deadlines arrive. Every major server vendor already offers Fibre Channel connectivity with FC-SP-3 autonomous in-flight encryption, and most storage OEMs are introducing compliant connectivity through 2026, so hardware bought on the normal cycle from here forward can arrive with the capability on board. That is what makes the rolling deployment credible rather than aspirational. Encryption-capable endpoints negotiate security automatically and coexist with older gear during the transition. Audit Mode lets administrators verify readiness before enforcement, preserving access to mission-critical data during the migration to stronger security. No forklift event is required, and no project needs to be scheduled around a compliance date. An organization that refreshes on its usual cadence and specifies FC-SP-3 connectivity as it goes arrives at 2030 with a fully encrypted SAN as a byproduct of procurement it was going to do anyway: compliant with CNSA 2.0, aligned with NIS2 and DORA encryption policies, and quantum-resistant end-to-end. Conclusion FC-SP-3 is not a flashy standard, and that is its virtue. It removes cryptography that should have been retired years ago, adds the NIST post-quantum algorithms that regulators now require, and replaces a compliance model that had drifted into absurdity with profiles built for interoperability. The completed specification lands years ahead of the mandates it satisfies, inside the refresh cycle enterprises were already planning. The hard part of deployment has been engineered away: no switch changes, no additional security infrastructure, no host CPU penalty, and an Audit Mode that makes the rollout observable before it is enforced. The caveat is that a standard is a toolset, not a deployment. Nothing encrypts itself; organizations still need to inventory their HBAs and storage fleet, specify FC-SP-3 connectivity in upcoming purchases, and turn on security as capable endpoints populate the fabric. For the regulated industries that depend most heavily on Fibre Channel (finance, healthcare, utilities, and government), that work has a deadline whether or not anyone schedules it. Harvest now, decrypt later means data stolen today is already exposed to the quantum computers of the next decade, so every year of unencrypted traffic has a cost that arrives later. FC-SP-3 makes closing that gap a procurement detail rather than a project, and it keeps Fibre Channel what it has been for two decades: the fabric that regulated industries trust with the data they can least afford to lose. For teams weighing where that data should live, our Best Storage Arrays page tracks the current enterprise array leaders, with audited benchmark results labeled separately from deployment evidence. FC-SP-3 Glossary This report is sponsored by the Fibre Channel Industry Association (FCIA). All views and opinions expressed in this report are based on our unbiased view of the product(s) under consideration. Learn more about the FC-SP-3 standard in the FCIA webinar Fibre Channel Security Prepares for Quantum Resistance.