NIST sets 2030 and 2035 cut-offs for RSA and elliptic-curve crypto

NIST sets 2030 and 2035 cut-offs for RSA and elliptic-curve crypto

21 October 2026: NIST has published the final version of IR 8547, its plan for moving off public-key cryptography that a quantum computer could break. RSA, ECDSA, EdDSA, finite-field Diffie-Hellman and MQV are deprecated after 2030 and disallowed under NIST standards and guidelines after 2035. For the most sensitive federal systems the deadlines are much earlier: post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031.

Not yet independently verified. This rests on the NIST report itself. We read the PDF, not NIST's news release, and have not read the texts of Executive Order 14412 or OMB M-26-15; their deadlines are given here as NIST states them. We will update this when it can be confirmed, and remove this note.

The report, approved by NIST's Editorial Review Board on 21 October, comes from the Computer Security Division's post-quantum team, among them Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson and David Cooper.

What deprecated and disallowed mean

The two words carry the schedule. A deprecated algorithm may still be used, but the owner of the data has to weigh the risk and decide. A disallowed one may no longer be used for that purpose under NIST rules. Between 2030 and 2035, organisations can keep running RSA and elliptic-curve schemes while they migrate to the replacements NIST has already standardised: ML-KEM (FIPS 203) for key establishment, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures.

This changes an older plan. NIST's long-term guidance in SP 800-57 had projected that schemes giving 112 bits of security, which includes 2048-bit RSA, would be disallowed on 1 January 2031. The report replaces that cliff with the 2030 to 2035 window for all quantum-vulnerable schemes.

The earlier federal deadlines

The window does not apply to the systems that matter most to federal buyers. According to the report, Executive Order 14412 and OMB memorandum M-26-15 require high value assets, high impact systems and other systems holding highly sensitive data to adopt post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. Agencies must also support TLS 1.3 by 2 January 2030 under Executive Order 14306 and the same memorandum. National Security Memorandum 10's target of 2035 for the whole federal migration stays in place.

NIST also warns that application-specific guidance may require quantum-resistant key exchange before 2035, because of "harvest now, decrypt later": traffic recorded today can be decrypted once a capable machine exists. It does not expect to standardise any further key-establishment scheme that is not quantum-resistant.

Why suppliers are on the clock

NIST notes that moving from a standard to full use in information systems has historically taken 10 to 20 years, and that the federal deadlines "leave little margin". Its advice is to start now with a cryptographic inventory, a migration plan and early deployments of products that support the new algorithms, and to identify systems that cannot support them for replacement or retirement.

For anyone selling VPNs, PKI, hardware security modules, code signing or managed TLS to US federal agencies, the 2030 date for key exchange is now the one that sets product roadmaps. Private companies are not bound by it, but their suppliers will build to it. Germany set a similar 2030 and 2035 pattern for its own systems, as we reported.

Our catalogue lists 13 VPN products and 9 key management tools, two of the categories this schedule reaches first.

Sources

• NIST IR 8547, Transition to Post-Quantum Cryptography Standards (October 2026; approved 21 October 2026), 21 October 2026
• Help Net Security: NIST maps out the post-quantum cryptography migration, 28 October 2026