NIST Finalises Post-Quantum Plan, Deprecating RSA and ECDSA After 2030

The US National Institute of Standards and Technology (NIST) has published the final version of its plan for moving encryption onto post-quantum algorithms. NIST IR 8547, released on 27 October, says the agency “will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035”.

That covers the workhorses of today’s internet security, including RSA, elliptic-curve signatures and Diffie-Hellman key exchange. The report also backs a US executive order that sets earlier deadlines for the government’s most sensitive systems: post-quantum key exchange by the end of 2030 and post-quantum signatures by the end of 2031.

What NIST published

The report’s five authors include Dustin Moody, the NIST mathematician who heads the agency’s post-quantum standardisation project. It lists which of NIST’s existing standards are vulnerable to a future quantum computer and what replaces them. NIST describes it in its announcement as “its high-level road map to help organizations switch to these standards”.

“We lay out how certain encryption algorithms people are using today will get phased out,” Moody said. “It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk.”

In NIST’s terms, a deprecated algorithm “may be used, but there is some security risk”, which the data owner must weigh; a disallowed one is “no longer allowed for the stated purpose”. The report’s tables mark ECDSA, EdDSA and RSA signatures, and finite-field and elliptic-curve Diffie-Hellman, MQV and RSA key establishment, as “Deprecated after 2030” and “Disallowed after 2035”.

For replacements, NIST points to the three standards it finalised in August 2024. It says ML-KEM, from FIPS 203, is currently “the only approved post-quantum key-establishment scheme based on public-key cryptography”, and recommends ML-KEM-768 as the default. A second scheme, HQC, has been selected and will also be approved once its standard is published. The report also accepts hybrid set-ups that combine classical and post-quantum methods, which NIST’s release likens to “using two padlocks on a door instead of one”.

The federal deadlines come from the executive order

Executive Order 14412, signed on 22 June 2026, tells the White House budget office to require agencies to move all high-value assets and high-impact systems to post-quantum key establishment “by December 31, 2030” and to post-quantum digital signatures “by December 31, 2031”. National security systems are excluded from that clause. The order also asks for a proposed procurement rule requiring covered contractors to comply with NIST’s standards, including the post-quantum ones, by 31 December 2030.

NIST’s report says the budget office’s memorandum M-26-15 puts this into practice and also requires agencies to support TLS 1.3 by 2 January 2030. The wider 2035 target for the whole federal migration, set by National Security Memorandum 10, stays in place. “While the memorandum applies specifically to federal systems, many organizations that work with the federal government will be affected as well,” NIST says.

Moody also pointed to NIST’s migration project at the National Cybersecurity Center of Excellence. “The new report can help you understand the standards and requirements of the migration,” he said, “while the NCCoE project can show you the practical tools and blueprints to get the job done.”

How the final plan tightens the 2024 draft

The most important change is easy to miss. The November 2024 draft split the old algorithms by strength: versions offering 112 bits of security would be deprecated after 2030, while stronger ones of 128 bits or more would simply be disallowed after 2035, with no deprecation step. In the final report, every quantum-vulnerable algorithm is deprecated after 2030, whatever its key size. From 2031, a system still relying on RSA-3072 or a P-256 elliptic curve is running on an algorithm that NIST says carries “some security risk”.

That matters beyond government. The executive order already ties federal contractors to NIST’s standards, and other countries build on them: Vietnam’s draft post-quantum signature standard is based on NIST’s FIPS 204, and central banks such as Spain’s and Portugal’s have agreed their own migration plans.

The report is blunt about the timetable. “Measured against the 10 to 20 years that previous cryptographic transitions have taken, these deadlines leave little margin,” it says. The Government Accountability Office found that no agency was fully prepared, and estimates of the quantum machine needed to break RSA keep falling: one firm recently claimed RSA-2048 could fall to fewer than 100,000 qubits. The reason for urgency is “harvest now, decrypt later”: data stolen today can be stored until a quantum computer can read it, which is why NIST and the order both put key exchange first.

Attackers are moving as well. Kaspersky has reported that a Lazarus tool already uses ML-KEM-1024 to protect its own traffic, and vendors such as Cloudflare are wrapping keys in ML-KEM-768. For most organisations, NIST’s advice is familiar but now has firmer dates: start with cryptographic inventories and migration planning, put post-quantum key establishment first for data that must stay secret for a long time, and look at the whole cryptographic supply chain, not only their own systems.

Sources

1. NIST: “NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards”, 27 October 2026.
2. NIST CSRC: NIST IR 8547, Transition to Post-Quantum Cryptography Standards (final), October 2026 (PDF).
3. NIST IR 8547 initial public draft, November 2024.
4. The White House: Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks”, 22 June 2026 (Federal Register).
5. NIST: FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard.
6. NCCoE: Migration to Post-Quantum Cryptography.

Related stories

• Cloudflare Adds Post-Quantum Lock to Keys That Must Stay in Region
• Spain and Portugal’s Central Banks Agree 3-Phase Post-Quantum Plan
• Vietnam Unveils Three Draft Post-Quantum Cryptography Standards
• Kaspersky Says Lazarus Used Post-Quantum Crypto in Attacks on 3 Korean Firms