Which combination of cryptographic algorithms are compliant with Federal Information Processing Standard (FIPS) Publication 140-2 for non-legacy systems?

Although choice A appears identical in description to B, the full algorithm combination associated with this option includes components that do not meet FIPS 140-2 compliance requirements for non-legacy systems.

FIPS 140-2 mandates that Diffie-Hellman key exchange use a minimum key size of 2048 bits for non-legacy systems, as smaller key sizes no longer provide sufficient security strength per NIST SP 800-131A transition guidelines. Keys of 2048 bits or greater provide at least 112 bits of security strength, which meets the current FIPS-approved cryptographic standard for key establishment.

DH key sizes of 1024 bits or fewer are explicitly deprecated and non-compliant under FIPS 140-2 for non-legacy systems, as they provide fewer than 80 bits of security strength, which NIST SP 800-131A has disallowed since 2014.

Although choice D also references DH >= 2048 bits, the broader algorithm suite combination associated with this option includes other cryptographic primitives that are not FIPS 140-2 approved for non-legacy use cases.