Five one-page flyers for different readers: an algorithm cheat sheet for engineers, a deadlines timeline for programme leads, a "harvest now, decrypt later" explainer for all staff, a CBOM one-pager, and a five-point board briefing. They use NIST IR 8547 (final, October 2026), FIPS 203, 204 and 205, EO 14412, OMB M-26-15 and CycloneDX 1.7, and each lists its sources.
Prints on one A4 or Letter page, in a light theme.
Algorithm cheat sheet
PQC in one page
PlayCISO
What a quantum computer would break, what replaces it, and the sizes you will plan for. Per NIST IR 8547 (final, October 2026) and FIPS 203, 204 and 205.
For: Engineers, architects, security teams
Quantum-vulnerable: deprecated after 2030, disallowed after 2035
Family
Spec
Used for
RSA
FIPS 186 / SP 800-56B
Signatures and key establishment
ECDSA, EdDSA
FIPS 186
Signatures
Finite field DH and MQV
SP 800-56A
Key establishment
Elliptic curve DH (ECDH) and MQV
SP 800-56A
Key establishment
The final IR 8547 applies this to every strength. The 2024 draft split some by strength; that split is gone.
Key establishment: ML-KEM (FIPS 203)
Set
Cat.
Encaps key
Ciphertext
ML-KEM-512
1
800 B
768 B
ML-KEM-768
3
1184 B
1088 B
ML-KEM-1024
5
1568 B
1568 B
Shared secret: 32 bytes. NIST recommends ML-KEM-768 as the default. HQC is selected as an alternative; its FIPS is under development.
Signatures: ML-DSA (FIPS 204)
Set
Cat.
Public key
Signature
ML-DSA-44
2
1312 B
2420 B
ML-DSA-65
3
1952 B
3309 B
ML-DSA-87
5
2592 B
4627 B
ML-DSA-44 drops to category 1 only with an approved RBG below 192 bits of security.
Signatures: SLH-DSA (FIPS 205), hash-based
Set (SHA2 / SHAKE)
Cat.
Public key
Signature
128s / 128f
1
32 B
7,856 / 17,088 B
192s / 192f
3
48 B
16,224 / 35,664 B
256s / 256f
5
64 B
29,792 / 49,856 B
"s" = small signatures, "f" = fast signing. 12 parameter sets in all.
Stateful hash-based: LMS, HSS, XMSS (SP 800-208)
Categories 3 and 5. "Not intended for general use but may be useful for applications like software and firmware signing" (IR 8547).
Symmetric and hash
AES-128 = category 1, AES-192 = 3, AES-256 = 5.
Approved symmetric primitives with at least 128 bits of classical security are believed to meet at least category 1.
SHA-1: disallowed in FIPS-validated modules after 2030.
Hybrid in TLS 1.3 today
X25519MLKEM768 (RFC 10024, August 2026, codepoint 0x11EC, Recommended: Y). OpenSSL 3.5 offers it by default; OpenSSH 10.0 defaults to mlkem768x25519-sha256.
TL;DR
What these flyers are
5 points+
Five printable one-page flyers on post-quantum cryptography, each with its sources.
Algorithm cheat sheet with FIPS 203, 204 and 205 parameter sets, categories and sizes.
Deadlines from NIST IR 8547 (final), EO 14412, OMB M-26-15 and the EU, UK, Canadian and German guidance.
A staff explainer on "harvest now, decrypt later" and Mosca, a CBOM one-pager, and a five-point board briefing.
Light theme when printed, sized for A4 or Letter.
Frequently asked questions
What are the PQC flyers?+
Five one-page flyers on post-quantum cryptography: an algorithm cheat sheet, a deadlines timeline, a "harvest now, decrypt later" and Mosca explainer for staff, a CBOM one-pager, and a five-point board briefing. Each one lists its sources.
Are the dates based on the final NIST IR 8547?+
Yes. They use the final version of 27 October 2026: RSA, ECDSA, EdDSA, DH, ECDH and MQV are deprecated after 2030 and disallowed after 2035 at every strength. Many pages still quote the 2024 draft, which split some families by strength.
Do the US 2030 and 2031 deadlines apply to private companies?+
Not directly. EO 14412 and OMB M-26-15 set them for US federal civilian high value assets and high impact systems, and M-26-15 does not apply to national security systems. A FAR rule for federal contractors was ordered but its text was not published as of November 2026.
Why are CNSA 2.0 and Australian dates not on the deadlines flyer?+
The NSA and ASD pages could not be read when the sources were checked on 13 November 2026. The flyer says so instead of printing dates nobody verified.
Can I print the flyers?+
You can read every flyer on screen. Printing or saving a flyer as a PDF is part of a paid plan. The printed version uses a light theme and fits one A4 or Letter page.
Who are the flyers for?+
The cheat sheet suits engineers, the timeline suits GRC and programme leads, the HNDL explainer suits all staff, the CBOM page suits AppSec and platform teams, and the board briefing suits executives.