Strengthen crypto minimum bit size requirement to resolve #2461

5.0/en/0x14-V6-Cryptography.md

@@ -57,7 +57,7 @@ Although this section is not easily penetration tested, developers should consid
 | **6.2.6** | [MOVED TO 6.5.3] | | | | |
 | **6.2.7** | [MOVED TO 6.5.4] | | | | |
 | **6.2.8** | Verify that all cryptographic operations are constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information. | | | ✓ | 385 |
-| **6.2.9** | [ADDED] Verify that all cryptographic primitives utilize a minimum of 128-bits of security, with exceptions only made for equipment or applications approaching end of life, where the requirement is at least 112-bits of security for all cryptography. | ✓ | ✓ | ✓ | 311 |
+| **6.2.9** | [ADDED] Verify that all cryptographic primitives utilize a minimum of 128-bits of security based on the algorithm, key size, and configuration. For example, a 256-bit ECC key provides roughly 128 bits of security where RSA requires a 3072-bit key to achieve 128 bits of security. | ✓ | ✓ | ✓ | 311 |
 
 ## V6.3 Random Values