NIST will deprecate RSA and elliptic-curve cryptography after 2030 in its final quantum plan

The National Institute of Standards and Technology (NIST) on October 27, 2026, published the final version of NIST IR 8547, Transition to Post-Quantum Cryptography Standards. The report sets the timetable for retiring the public-key algorithms that a future quantum computer could break. Under it, NIST will deprecate all quantum-vulnerable public-key cryptography in its standards after 2030 and disallow it after 2035. That covers RSA, the elliptic-curve signature schemes ECDSA and EdDSA, and Diffie-Hellman and MQV key exchange.

The final version is stricter than the draft NIST released on November 12, 2024. The draft proposed deprecating only algorithms at the 112-bit security level after 2030, leaving stronger 128-bit versions acceptable until they were disallowed after 2035. The final report deprecates every strength after 2030.

The labels matter for anyone selling to the US government. In NIST's terms, a deprecated algorithm may still be used, but the data owner must weigh the security risk. A disallowed one may no longer be used for that purpose. NIST's older guidance had planned to disallow 112-bit public-key schemes on January 1, 2031.

Federal deadlines come sooner

For the most sensitive federal systems, the 2030-2035 window is not the real deadline. National Security Memorandum 10 set 2035 as the target for completing the federal migration. Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, signed on June 22, 2026, and the Office of Management and Budget's memorandum M-26-15 brought dates forward for high-value assets and high-impact systems. Those must adopt post-quantum key establishment by December 31, 2030, and post-quantum digital signatures by December 31, 2031. Agencies must also support version 1.3 of TLS, the protocol that protects internet data exchanges, by January 2, 2030.

The report notes that earlier cryptographic transitions took 10 to 20 years, so these deadlines leave little margin. It says organizations should start with inventories of where they use cryptography and migration plans.

What replaces the old algorithms

• Key establishment: ML-KEM (FIPS 203) is the only approved post-quantum scheme for now. NIST recommends ML-KEM-768 as the default. HQC has been selected as an alternative and will be approved once its standard is published.
• Digital signatures: ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and the stateful hash-based schemes LMS, HSS, XMSS and XMSS^MT (SP 800-208).
• Hybrids: a scheme that combines classical and post-quantum methods can be validated under FIPS 140 as long as at least one input comes from an approved scheme.
• Symmetric encryption and hashing: approved algorithms with at least 128-bit strength are believed to meet NIST's lowest post-quantum security category, but its few 112-bit symmetric standards will be disallowed in 2030.

Why the rush

No quantum computer capable of breaking today's public-key encryption exists yet. The main worry is “harvest now, decrypt later”: attackers can store encrypted traffic today and read it once such a machine arrives. That is why, Moody said, organizations might move first to ML-KEM (FIPS 203) for data that is particularly sensitive or must stay secret for a long time.

“We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing,” said Dustin Moody, the NIST mathematician who heads the post-quantum standardization project.

What comes next

NIST says it will revise SP 800-131A, its main guidance on algorithm transitions for federal agencies, with more detailed guidelines and schedules. Its National Cybersecurity Center of Excellence is running a cross-sector project on finding where cryptography is used, managing the risk, and demonstrating post-quantum implementations. The federal deadlines apply to government systems, but NIST expects them to reach many of the organizations that do business with the federal government too.