NIST IR 8547 Final: RSA and ECC Out by 2035, What to Do
TL;DR · the short version
NIST published the final NIST IR 8547, "Transition to Post-Quantum Cryptography Standards", on 27 October 2026. All quantum-vulnerable public-key algorithms (RSA, ECDSA, EdDSA, finite-field and elliptic-curve Diffie-Hellman, MQV) are deprecated after 2030 and disallowed after 2035, at every key strength. The replacements are ML-KEM (FIPS 203) for key establishment, with ML-KEM-768 as the default, and ML-DSA (FIPS 204), SLH-DSA (FIPS 205) or stateful hash-based signatures for signing. US federal high value assets and high impact systems face earlier dates under EO 14412 and OMB M-26-15: key establishment by 31 December 2030 and signatures by 31 December 2031.
NIST published the final NIST IR 8547, "Transition to Post-Quantum Cryptography Standards", on 27 October 2026. It sets the end of today's public-key cryptography under NIST standards: RSA, ECDSA, EdDSA, Diffie-Hellman, elliptic-curve Diffie-Hellman and MQV are deprecated after 2030 and disallowed after 2035, at every key strength. US federal high-value and high-impact systems have earlier dates: post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031, under Executive Order 14412 and OMB memo M-26-15.
What is new and what is not
- New (Oct 2026): IR 8547 is final. The November 2024 draft had a split by strength (only 112-bit keys were to be deprecated in 2030). The final drops it: every quantum-vulnerable public-key family is deprecated after 2030 and disallowed after 2035.
- New (Jun 2026): EO 14412 and OMB M-26-15 moved the federal deadlines for the most sensitive systems to 2030 (key establishment) and 2031 (signatures).
- Not new: the algorithms. ML-KEM, ML-DSA and SLH-DSA were published as FIPS 203, 204 and 205 on 13 August 2024.
- Still coming: FN-DSA (from Falcon) and an HQC standard. NIST says both are in development; no draft of either was on NIST's site on 13 November 2026.
A post going around LinkedIn calls IR 8547 "just released" and sums it up as high-impact systems by 2030 and everything by 2035. That is broadly right for US federal systems. Two corrections: the final came out on 27 October, and the 2031 date for signatures is separate from the 2030 date for key establishment.
What the final IR 8547 says
| Algorithm family | Standard | After 2030 | After 2035 |
|---|---|---|---|
| RSA (signatures and key establishment) | FIPS 186, SP 800-56B | Deprecated | Disallowed |
| ECDSA | FIPS 186 | Deprecated | Disallowed |
| EdDSA | FIPS 186 | Deprecated | Disallowed |
| Finite-field DH and MQV | SP 800-56A | Deprecated | Disallowed |
| Elliptic-curve DH and MQV | SP 800-56A | Deprecated | Disallowed |
The words matter. NIST, quoting SP 800-131A: "Deprecated means that the algorithm and key length/strength may be used, but there is some security risk." "Disallowed means that the algorithm, key length/strength, parameter set, or scheme is no longer allowed for the stated purpose." After disallowal, old keys can still be used to decrypt or verify what they already protected ("legacy use").
NIST is direct about the window: "The 2030-2035 deprecation window accommodates lower-risk systems and applications with legacy constraints while full migration concludes. Crucially, this window does not alter the earlier deadlines that apply to high value assets, high impact systems, and other high-sensitivity federal systems". And: "Systems that cannot support post-quantum cryptography should be identified and prioritized for replacement or decommissioning".
The replacements
| Use | Algorithm | Parameter sets (category) |
|---|---|---|
| Key establishment | ML-KEM (FIPS 203) | ML-KEM-512 (1), ML-KEM-768 (3, NIST's default), ML-KEM-1024 (5) |
| Signatures | ML-DSA (FIPS 204) | ML-DSA-44 (2), ML-DSA-65 (3), ML-DSA-87 (5) |
| Signatures | SLH-DSA (FIPS 205) | 12 sets, 128/192/256 in "s" (small) and "f" (fast) variants (1, 3, 5) |
| Firmware and software signing | LMS/HSS, XMSS (SP 800-208) | Categories 3 and 5; NIST: "not intended for general use" |
NIST: "NIST recommends using ML-KEM-768 as the default parameter set, as it provides a large security margin at a reasonable performance cost." HQC was selected on 11 March 2025 as a backup KEM; NIST said then that ML-KEM "will remain the recommended choice for general encryption".
Symmetric crypto and hashes
AES-128 and up are fine: NIST says approved symmetric primitives with at least 128 bits of classical security "are believed to meet the requirements of at least Category 1 security". Two clean-ups have a 2030 date: the few 112-bit symmetric standards "will be disallowed in 2030", and SHA-1 "will be disallowed for use in FIPS-validated cryptographic modules after 2030".
Hybrid
NIST does not require hybrid, but will accept it: it "will accommodate the use of a hybrid key-establishment mode and dual signatures in FIPS 140 validation when suitably combined with a NIST-approved scheme", and expects hybrids to be "temporary measures". In TLS the common hybrid is now standardised: RFC 10024 (August 2026) defines X25519MLKEM768 (codepoint 0x11EC, marked Recommended), SecP256r1MLKEM768 and SecP384r1MLKEM1024.
Useful next, if this was relevant to you
Deadlines by jurisdiction
| Who | Deadline | Source |
|---|---|---|
| Anyone following NIST standards | Deprecated after 2030, disallowed after 2035 | NIST IR 8547 (Oct 2026) |
| US federal HVAs and high impact systems | PQC key establishment by 31 Dec 2030; PQC signatures by 31 Dec 2031 | EO 14412 (22 Jun 2026), OMB M-26-15 (24 Jun 2026) |
| US federal agencies | Support TLS 1.3 by 2 Jan 2030; overall goal 2035 | EO 14306, M-26-15; NSM-10 |
| US federal contractors | FAR rule proposed to require compliance with NIST FIPS, including PQC, by 31 Dec 2030 | EO 14412 Sec. 6(c): proposed rule due within 180 days of the order |
| EU member states | Start by end-2026; high-risk use cases by end-2030; as many systems as feasible by 2035 | EU coordinated roadmap (Jun 2025) |
| United Kingdom | Discovery and plan by 2028; priority migrations by 2031; complete by 2035 | NCSC (Mar 2025) |
| Canada (federal IT) | Plans from April 2026; high-priority systems by end-2031; rest by end-2035 | CCCS ITSM.40.001 (Jun 2025) |
| Germany | Classic key agreement alone recommended only to end-2031 (end-2030 for very high protection); hybrid recommended | BSI TR-02102-1 (Jan 2026) |
NSA's CNSA 2.0 timeline for national security systems, Australia's guidance and France's ANSSI position are widely quoted, but their pages refused our requests, so we have not repeated their dates here. Our PQC deadline calculator shows the dates that apply to you, with years and days left.
Why the rush: harvest now, decrypt later
IR 8547: "Encrypted data remains at risk because of the "harvest now, decrypt later" threat in which adversaries collect encrypted data now with the goal of decrypting it once quantum technology matures." That is why key establishment comes first. NIST also restates Mosca's theorem: if X is how long data must stay secret and Y is how long migration takes, you must start before X plus Y passes the arrival of a quantum computer able to break today's keys. Signatures are not exposed to harvesting, but NIST says moving them is "also urgent due to the longer duration and greater complexity of the transition process".
What security leaders should do this quarter
- Build the inventory. OMB calls "a dynamic, continuously updated inventory of all cryptographic assets" the foundation, populating "a central Cryptographic Bill of Materials (CBOM)". Start one in CycloneDX 1.7 with our CBOM generator, or download the sample CBOM.
- Classify it. Paste the CBOM into the CBOM analyzer to see what is quantum-vulnerable and which IR 8547 date applies.
- Put key establishment first for traffic and data that must stay secret for years: turn on hybrid X25519MLKEM768 where your TLS stack supports it, and move to TLS 1.3.
- Find what cannot upgrade. Appliances, HSMs and embedded devices without a PQC path go on a replace-or-retire list now; CISA's January 2026 list says that where PQC-capable products are widely available, buyers "should plan acquisitions to procure only PQC-capable products".
- Clean up the easy wins: SHA-1, 112-bit symmetric keys and anything still below TLS 1.3.
- Plan and rehearse. Use the PQC migration project plan and RACI, then run the PQC migration lab. Teams preparing for exams can use PQC exam practice and the printable PQC flyers.
Everything above is in order on the PQC practice path. For the basics of symmetric, asymmetric and hashing, read our cryptography guide; for a quick self-check, the crypto-agility and PQC readiness checklist.
FAQ
What is NIST IR 8547?
NIST IR 8547, "Transition to Post-Quantum Cryptography Standards", is NIST's plan for moving from quantum-vulnerable public-key cryptography to post-quantum standards. The initial public draft came out on 12 November 2024 and the final on 27 October 2026. It lists which algorithms are deprecated and disallowed, and when, and which post-quantum algorithms replace them.
When will RSA and ECC be disallowed?
Under the final NIST IR 8547, RSA, ECDSA, EdDSA, finite-field and elliptic-curve Diffie-Hellman and MQV are deprecated after 2030 and disallowed under NIST standards and guidelines after 2035, at every key strength. Deprecated means they may still be used with some risk; disallowed means they are no longer allowed for the stated purpose.
Is NIST IR 8547 final?
Yes. NIST published the final version on 27 October 2026, replacing the November 2024 draft. The final drops the draft's split by key strength: every quantum-vulnerable public-key family now has the same 2030 deprecation and 2035 disallow dates.
What are the US federal post-quantum deadlines?
Executive Order 14412 (22 June 2026) and OMB M-26-15 (24 June 2026) require federal high value assets and high impact systems to use post-quantum cryptography for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. Agencies must also support TLS 1.3 by 2 January 2030. The overall 2035 goal from NSM-10 remains.
Which algorithms replace RSA and ECC?
For key establishment, ML-KEM (FIPS 203); NIST recommends ML-KEM-768 as the default and HQC has been selected as a backup, with its standard still in development. For signatures, ML-DSA (FIPS 204), SLH-DSA (FIPS 205) and, for uses such as firmware signing, the stateful hash-based LMS and XMSS (SP 800-208). A Falcon-based standard, FN-DSA, is also in development.
Does AES need to change for post-quantum?
Not the 128-bit and stronger versions. NIST IR 8547 says approved symmetric primitives with at least 128 bits of classical security are believed to meet at least post-quantum category 1. The few 112-bit symmetric standards will be disallowed in 2030, and SHA-1 will be disallowed in FIPS-validated modules after 2030.
What is a CBOM and do I need one?
A cryptographic bill of materials lists the algorithms, keys, certificates and protocols a system uses. OMB M-26-15 calls a continuously updated inventory, populating a central CBOM, the foundation of the migration plan, and EO 14412 asks CISA and NIST to publish minimum CBOM elements. CycloneDX 1.7 is the current format.
Sources
- NIST IR 8547 (final, 27 Oct 2026) and PDF (read); initial public draft (12 Nov 2024)
- NIST news release, 27 Oct 2026 (read)
- FIPS 203, FIPS 204, FIPS 205 (13 Aug 2024; read)
- NIST selects HQC (11 Mar 2025) (read)
- Executive Order 14412 (22 Jun 2026) and OMB M-26-15 (24 Jun 2026) (read)
- CISA: PQC product categories (23 Jan 2026) (read)
- RFC 10024: hybrid ML-KEM key agreement for TLS 1.3 (Aug 2026) (read)
- EU coordinated PQC roadmap (Jun 2025), UK NCSC migration timelines (Mar 2025), Canada ITSM.40.001 (Jun 2025), BSI TR-02102-1 (Jan 2026) (read)
- CycloneDX specification (1.7, 21 Oct 2025) (read)