NIST Finalizes IR 8547 Roadmap for Transition to Post-Quantum Cryptography Standards
Key Takeaways
Timeline Clarity: NIST IR 8547 deprecates quantum-vulnerable public-key algorithms after 2030 and disallows them after 2035.
Priority Deadlines: Federal high-value assets and high-impact systems require PQC key establishment by December 31, 2030, and digital signatures by December 31, 2031.
Algorithm Mapping: FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA form the primary replacement standards.
The National Institute of Standards and Technology (NIST) published the final NIST IR 8547, Transition to Post-Quantum Cryptography Standards, on October 27, 2026. The report details the official approach and timelines for migrating from quantum-vulnerable public-key cryptography to the post-quantum standards released in August 2024. It supports implementation of Executive Order 14412 and OMB Memorandum M-26-15 for federal systems while providing guidance applicable to industry partners and standards organizations.
Algorithm Deprecation and Replacement Standards
The report identifies quantum-vulnerable algorithms in existing NIST standards, including RSA, Diffie-Hellman, ECDH, ECDSA, and EdDSA at approved security strengths of 112 bits or higher. These face deprecation after 2030, during which use remains possible subject to risk assessment by the data owner, and complete disallowance under NIST standards and guidelines after 2035.
Replacements center on FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), with ML-KEM-768 recommended as the default parameter set, FIPS 204 Module-Lattice-Based Digital Signature Algorithm (ML-DSA), and FIPS 205 Stateless Hash-Based Signature Algorithm (SLH-DSA).
Hybrid constructions combining classical and post-quantum methods remain available during the transition period via updated guidance in SP 800-56C and related publications.
Dustin Moody, who leads the NIST PQC standardization project, noted different use cases may require varying migration durations.
| Mechanism | Vulnerable Standards | PQC Targets | Timeline |
|---|---|---|---|
| Key Establishment | RSA, DH, ECDH (SP 800-56A/B) | ML-KEM (FIPS 203); HQC in development | Deprecated after 2030; Disallowed after 2035; Federal HVA by Dec 31, 2030 |
| Digital Signatures | RSA, ECDSA, EdDSA (FIPS 186) | ML-DSA (FIPS 204), SLH-DSA (FIPS 205) | Deprecated after 2030; Disallowed after 2035; Federal HVA by Dec 31, 2031 |
Federal and Industry Migration Implications
National Security Memorandum 10 established 2035 as the target for completing the federal migration to post-quantum cryptography. Executive Order 14412 accelerates this for high-value assets and high-impact systems, requiring PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. OMB Memorandum M-26-15 operationalizes the order, directing agencies to submit migration plans by October 22, 2026, and to prioritize systems holding data expected to remain sensitive in 2030. The report complements the NIST National Cybersecurity Center of Excellence (NCCoE) Migration to Post-Quantum Cryptography project, which develops practical demonstrations and tools for cryptographic inventory, risk prioritization, and agile implementation. Organizations outside the federal government, particularly those interacting with federal systems or managing long-lived sensitive data, face similar urgency due to the harvest-now-decrypt-later threat.
Bottom Line
NIST IR 8547 establishes the definitive technical roadmap and timelines for retiring quantum-vulnerable public-key cryptography in favor of standardized post-quantum alternatives.
Find out more here.
—
Further articles, reports, and the latest quantum computing news may be found at The Qubit Report.
- Cryptographic Migration, Executive Order 14412, Federal Information Processing Standards (FIPS), Module-Lattice-Based Digital Signature Algorithm (ML-DSA), Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), National Institute of Standards and Technology (NIST), NIST IR 8547, Office of Management and Budget (OMB), Post-Quantum Cryptography (PQC), Stateless Hash-Based Signature Algorithm (SLH-DSA)
Related Articles
World Quantum Cannes Festival Outlines Investor Day Program for Quantum Capital Formation
The World Quantum Cannes Festival has detailed its Investor Day Program for the November 17-18, 2026 inaugural edition in Cannes. Supervised by Honorary Committee members
The Qubit Report: October 27, 2026
The Qubit Report for October 27, 2026 arrives with processors rewriting magnet theory, wave algorithms stretching into acoustics and structural loads, and defense networks locking
The Qubit Report: October 26, 2026
Dark fiber now carries IonQ quantum key distribution between Palm Beach State College and FAU, lighting the first operational segment of Florida’s statewide quantum-safe network.