The post-quantum transition now has firm dates. On Oct. 27, NIST published the final version of NIST Internal Report (IR) 8547, Transition to Post-Quantum Cryptography Standards. The report sets out the agency's official approach and timelines for moving off quantum-vulnerable algorithms and onto the quantum-resistant standards NIST released in August 2024.

The main point fits in one sentence. NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow it in NIST standards after 2035. For federal agencies, a separate set of executive-branch deadlines arrives earlier, and the first of them is about three years away.

If you have seen IR 8547 described as a 2024 draft, that description is out of date. This is the finalized document. Its authors are NIST's Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson and David Cooper.

Why this report exists

Most of the internet's security rests on public-key cryptography, the math that lets two parties agree on a shared secret key and lets software prove it came from who it claims. A large enough quantum computer would break the public-key algorithms in use today. Nobody has to wait for that machine to exist before it becomes a problem. NIST's announcement points to the "harvest now, decrypt later" threat: an adversary records encrypted traffic today, stores it, and decrypts it once quantum capability arrives. Any data that has to stay confidential for years is already exposed to this.

NIST's abstract describes IR 8547 as a guide for moving from quantum-vulnerable algorithms to post-quantum signature and key-establishment schemes. It identifies the existing quantum-vulnerable standards and the quantum-resistant standards meant to replace them. The report is also meant to start conversations with industry, standards bodies and federal agencies, and it explicitly supports implementation of Executive Order 14412.

NIST says the timelines and migration activities are aimed at federal agencies, but the report is also written for technology providers and any organization drawing up its own quantum-readiness roadmap. "We understand there's not one strategy that fits all use cases," NIST mathematician Dustin Moody said in the agency's announcement.

Deprecated vs. disallowed: what the words mean

The two terms do different jobs, and it is easy to read past the difference.

  • Deprecated (after 2030): The algorithm is still allowed, but at the user's own risk. NIST's Dustin Moody describes this as "allowed but at the user's own risk."
  • Disallowed (after 2035): The algorithm may no longer be used under NIST standards and guidelines.

Quantum Computing Report's summary table lists the status as "Deprecated: 2031–2035; Disallowed: Dec 31, 2035." That is looser than NIST's own wording. The authoritative phrasing is "deprecate after 2030, disallow after 2035."

The federal deadlines come first

NIST's dates are the outer limit. As Help Net Security notes, the federal government's own requirements are tighter in several places:

  • 2035: National Security Memorandum 10 set 2035 as the target for completing the federal post-quantum transition. This matches NIST's disallow date.
  • Jan. 2, 2030: Executive Order 14306 and OMB Memorandum M-26-15 require agencies to support TLS 1.3.
  • Dec. 31, 2030: Under EO 14412 and M-26-15, federal high-value assets, high-impact systems and other prioritized sensitive systems must adopt quantum-resistant key establishment.
  • Dec. 31, 2031: The same systems must adopt quantum-resistant digital signatures.

Key establishment comes first, which fits the "harvest now, decrypt later" threat: traffic captured today is only safe if the key exchange that protected it holds up against a future quantum computer. Signatures get an extra year.

What replaces what

According to Quantum Computing Report's breakdown of the final document, the replacement algorithms are:

  • Key establishment: ML-KEM, specified in FIPS 203.
  • Digital signatures: ML-DSA (FIPS 204) and SLH-DSA (FIPS 205).
  • Firmware and boot signing: stateful hash-based signatures under SP 800-208.
  • Hybrid modes: guidance in SP 800-56C and SP 800-227 covers combining classical and post-quantum schemes during the transition.

Hybrid modes deserve attention. NIST describes the hybrid approach as combining conventional encryption with post-quantum cryptography, like using two padlocks on a door instead of one. It is more conservative from a security standpoint but demands more computational resources.

Does this apply to me if I'm not a federal agency?

Strictly speaking, the EO 14412 and M-26-15 deadlines apply to federal agencies. NIST notes, however, that many organizations that work with the federal government will be affected as well, and the report looks at an organization's entire cryptographic supply chain, not just its own components. It is reasonable to infer that if an agency's high-value system has to use quantum-resistant key establishment by the end of 2030, the products and services in that system will need to support it, so federal suppliers should expect questions about it.

NIST says the report is also meant for industry and standards bodies, and the timelines apply broadly. Commercial vendors outside the federal market may therefore want to use the same dates in their own planning.

Why 2035 is not far away

A decade sounds like plenty of time, but NIST's own history says otherwise. The agency notes that past cryptographic transitions took 10 to 20 years. Cryptography is built into hardware, firmware, protocols, libraries, embedded devices and vendor products with long replacement cycles. By that measure, organizations starting in 2026 are not early. They are just on schedule.

What It Means for Defenders

Nothing needs an emergency patch this week. This is a planning deadline, not a vulnerability. Even so, the work the sources describe is slow, and the earliest federal date, Jan. 2, 2030, is about three years out. Here is what the guidance points to:

  • Build a cryptographic inventory now. NIST urges organizations to identify where cryptography is used and plan changes. You can't migrate what you haven't found. Record where your organization uses public-key cryptography for key establishment and for signatures: TLS endpoints, VPNs, code and firmware signing, certificates, and the cryptography inside third-party products.
  • Prioritize long-lived secrets. NIST's Moody says organizations might prioritize migrating to the key establishment standard (FIPS 203) for data that is particularly sensitive or needs to be kept secure for a long time. If information must stay secret past the point when a quantum computer could plausibly read it, it is the most exposed to "harvest now, decrypt later" and should be migrated first.
  • Get to TLS 1.3. Agencies must support TLS 1.3 by Jan. 2, 2030. For anyone serving federal customers, this is the nearest concrete milestone, and it is something you can check across your environment today.
  • Plan key establishment before signatures. The federal order is quantum-resistant key establishment (ML-KEM, FIPS 203) by Dec. 31, 2030, then signatures (ML-DSA, FIPS 204, or SLH-DSA, FIPS 205) by Dec. 31, 2031. Hybrid modes under SP 800-56C and SP 800-227 offer a transition path.
  • Don't forget firmware and boot chains. Code that verifies firmware and boot images is some of the hardest to change once it ships. According to Quantum Computing Report, the final report approves stateful hash-based signatures (SP 800-208) for software, firmware and secure boot signing, so ask hardware and device vendors what they support.
  • Ask your vendors for roadmaps. NIST wrote the report partly for technology providers. Ask your suppliers when their products will support the replacement algorithms. If you serve federal customers, expect them to ask you the same thing.
  • Track the deprecation dates in policy. After 2030, quantum-vulnerable public-key algorithms are deprecated, meaning allowed only at the user's own risk. Plan now for which systems would still depend on them.

As Moody put it, no single strategy fits every use case. The calendar, however, applies to everyone.

Sources