How should cryptographic algorithms be chosen and updated under Annex F?

• A. Based on vendor popularity
• B. Based on current standards, strength tests, import/export considerations, and update path for deprecation
• C. Randomly selected for each project
• D. Based solely on fastest computation time

Answer: (B)

Selecting cryptographic algorithms and planning their updates under Annex F should follow standards, be backed by strength testing, consider import/export constraints, and include a clear deprecation/update path. Relying on current standards ensures interoperability and a recognized security baseline that many organizations rely on. Strength tests confirm that an algorithm actually resists known attacks in practice, not just in theory, giving real assurance about its resilience. Import/export considerations address legal and regulatory constraints that can affect which algorithms you may use in different regions or for different partners. Finally, an explicit update path for deprecation ensures you can migrate to stronger algorithms before weaknesses are exploited, maintaining confidentiality and integrity over time. Choosing based on popularity or speed alone ignores security guarantees and lifecycle risk, and random selection would introduce instability and potential vulnerabilities.