Policy and regulation · Quantum-Safe
NIST finalises its post-quantum roadmap: RSA and ECDSA out of its standards after 2035
NIST's post-quantum roadmap deprecates RSA and elliptic-curve cryptography after 2030 and disallows them after 2035. Critical federal systems must move sooner.
Key points
- NIST will deprecate quantum-vulnerable public-key cryptography (RSA, ECDSA, EdDSA, Diffie-Hellman and MQV) after 2030 and disallow it in its standards after 2035.
- High-value and high-impact federal systems must use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031.
- Symmetric encryption stays: AES at 128 bits or more and SHA-256 remain acceptable. Only 112-bit symmetric primitives are disallowed in 2030.
The US National Institute of Standards and Technology (NIST) published the final version of its post-quantum roadmap on 27 October: the report NIST IR 8547, Transition to Post-Quantum Cryptography Standards. It sets out which public-key algorithms in its standards a quantum computer could break, when they will stop being acceptable and which post-quantum cryptography (PQC) standards organisations should move to. The draft had been published in November 2024.
It is aimed at federal agencies, technology vendors, standards bodies and the laboratories of the Cryptographic Module Validation Program (CMVP). NIST also presents it as a reference for critical infrastructure operators and for any organisation preparing the same migration.
The timeline: deprecated after 2030, disallowed after 2035
All the quantum-vulnerable signature and key-establishment algorithms that NIST approves today become deprecated after 2030 and disallowed after 2035. Deprecated means they may still be used, but the data owner accepts the risk; disallowed means they are no longer allowed for that purpose.
| Algorithm | Use | After 2030 | After 2035 |
|---|---|---|---|
| RSA, ECDSA and EdDSA (FIPS 186) | Digital signature | Deprecated | Disallowed |
| Finite-field and elliptic-curve Diffie-Hellman and MQV (SP 800-56A) | Key establishment | Deprecated | Disallowed |
| RSA (SP 800-56B) | Key establishment | Deprecated | Disallowed |
This changes what the key management guideline SP 800-57 had planned: disallowing public-key schemes at the 112-bit security level on 1 January 2031. Instead, those schemes follow the same timeline as the rest: deprecated after 2030 and out of the standards after 2035.
Shorter deadlines for the most sensitive federal systems
The overall goal set by National Security Memorandum 10 (NSM-10), completing the federal migration by 2035, still stands. But Executive Order 14412, of 22 June 2026, and the Office of Management and Budget (OMB) memorandum M-26-15, of 24 June, bring the deadlines forward for the most sensitive systems:
- Agencies must reduce as much quantum risk as possible by 31 December 2030, starting with the highest priorities.
- High-value assets and high-impact systems must use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. Systems holding data that will still be sensitive in 2030 have the same priority.
- Agencies must support TLS 1.3 by 2 January 2030.
Note · the margin to 2035 is not for everyone
The 2030 to 2035 period is for lower-risk systems and those with legacy constraints. The report makes clear that it does not change the earlier deadlines for high-value, high-impact or highly sensitive federal systems.
The deadlines in the executive order and the memorandum apply to the US federal government. According to NIST’s announcement, they will also affect many organisations that work with it.
What to migrate to
- Digital signatures: ML-DSA (FIPS 204) and SLH-DSA (FIPS 205). The stateful signatures LMS and XMSS (SP 800-208) are not for general use, but can be used to sign software and firmware. NIST is preparing another standard with an algorithm derived from FALCON.
- Key establishment: ML-KEM (FIPS 203) is currently the only approved post-quantum scheme, and NIST recommends ML-KEM-768 as the default parameter set. HQC, selected as an alternative, will be approved once its standard, now in preparation, is published.
- Symmetric cryptography: NIST does not plan to retire it. Approved primitives with at least 128 bits of security, such as AES-128 or SHA-256, meet at least post-quantum security category 1. Those at 112 bits will be disallowed in 2030, and SHA-1 will not be allowed in validated modules after 2030.
NIST does not plan to standardise any further signature or key-establishment algorithms that are not resistant to a quantum computer.
Hybrids, accepted as an interim step
The report accepts hybrid key establishment and dual signatures in FIPS 140 validation, provided that one of the components is a NIST-approved scheme. It does warn that they add complexity and that they are expected to be temporary, ahead of a second transition to post-quantum-only algorithms. It leaves the decision to use them to each application. On certificates with hybrid encryption, we covered Composite ML-KEM.
TLS is an early priority, because it protects data in transit for almost all federal systems and is the main target of the harvest now, decrypt later threat. TLS 1.3 already allows post-quantum key establishment, including hybrid mechanisms that combine ML-KEM with classical algorithms; guidance will come in the next revision of SP 800-52.
“We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing”
Dustin Moody, NIST mathematician who leads the PQC standardisation project, 27 October 2026
What the report asks for
That organisations treat the migration as a current operational priority, starting with the cryptographic inventory, the migration plan and the first deployments of products with PQC. It asks cryptographic hardware vendors to integrate PQC immediately, given long design and manufacturing lead times. And systems that cannot use PQC should be identified and prioritised for replacement or retirement.