The US National Institute of Standards and Technology (NIST) has finalized its roadmap for transitioning to post-quantum cryptography.
The announcement outlines how organizations should replace vulnerable algorithms and meet federal migration deadlines beginning in 2030.
The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), identifies the cryptographic standards affected by future quantum attacks and their quantum-resistant replacements. It supports an accelerated migration for sensitive federal systems while retaining 2035 as the overall federal transition target.
NIST warns that previous cryptographic transitions have taken 10 to 20 years, leaving little room for delay. The work extends across software libraries, network protocols, hardware security modules, digital certificates, and the applications that depend on them.
The agency released its first three post-quantum cryptography standards in August 2024. These cover ML-KEM for establishing shared secret keys, and ML-DSA and SLH-DSA for digital signatures used to verify authenticity and detect tampering.
Earlier deadlines for sensitive systems
Under Executive Order 14412 and OMB Memorandum M-26-15, federal high-value assets and high-impact systems must adopt post-quantum key establishment by December 31, 2030, and post-quantum digital signatures by December 31, 2031.
Agencies must give the same priority to other systems holding highly sensitive information, including data expected to remain mission-sensitive in 2030.
More broadly, NIST plans to deprecate quantum-vulnerable public-key algorithms after 2030 and disallow their use under its standards and guidelines after 2035. Affected techniques include RSA, elliptic-curve signature algorithms ECDSA and EdDSA, and conventional Diffie-Hellman key establishment.
During deprecation, continued use remains possible following a risk assessment, subject to applicable requirements. That window does not extend the earlier federal deadlines.
Protecting data collected today
Although no existing quantum computer can currently break these cryptographic protections at relevant security levels, encrypted information faces a longer-term privacy threat.
Adversaries can collect encrypted communications today and retain them until quantum computers become powerful enough to decrypt them. This “harvest now, decrypt later” risk makes protecting medical records, government secrets, and other long-term sensitive information a priority.
NIST identifies TLS, which protects internet communications, as an early migration focus. It recommends ML-KEM-768 as the default post-quantum key-establishment parameter set, balancing a substantial security margin against performance costs.
The report also accommodates hybrid implementations combining conventional and post-quantum algorithms. These can preserve protection if one component fails, but they also add engineering complexity, performance overhead, and potential implementation risks.
The transition does not require replacing every cryptographic primitive. NIST considers approved symmetric algorithms such as AES significantly less vulnerable to known quantum attacks and does not expect to replace them as part of this migration.
Organizations should start by inventorying cryptographic dependencies, identifying information that requires long-term confidentiality, and obtaining migration plans from technology suppliers. Systems unable to support post-quantum cryptography should be prioritized for replacement or retirement.
Leave a Reply