GRC

NIST finalises post-quantum deadlines: RSA and ECC out by 2035

NIST’s final IR 8547 deprecates RSA and elliptic curve crypto after 2030 and bans it after 2035. What it means for UK firms and NCSC PQC milestones.

Padlock graphic with the headline RSA and ECC retire by 2035

NIST has published the final version of IR 8547 and fixed the end dates for RSA, elliptic curve and Diffie-Hellman cryptography: deprecated after 2030 and disallowed after 2035. The US timetable now runs alongside the NCSC’s 2028, 2031 and 2035 milestones, so UK organisations have no further reason to delay their post-quantum planning.

What happened

On 27 October 2026 the US National Institute of Standards and Technology released the final text of NIST IR 8547, Transition to Post-Quantum Cryptography Standards. The initial public draft was published in November 2024. The final report confirms that NIST will deprecate quantum-vulnerable public-key algorithms after 2030 and disallow them under its standards and guidelines after 2035.

The bigger change is in scope. The draft deprecated only the 112-bit security parameters after 2030 and left stronger key sizes until the 2035 cut-off. The final version deprecates every approved strength after 2030. That means P-256, P-384, RSA-3072 and Ed25519 enter the deprecation window together, as postquantum.com’s comparison of the two versions points out. In NIST’s vocabulary, a deprecated algorithm remains usable at the owner’s risk, while a disallowed one is barred for that purpose.

The report also brings NIST’s guidance into line with two newer US instruments, Executive Order 14412 and OMB Memorandum M-26-15. Under these, the most sensitive US federal systems must adopt post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. Separately, Executive Order 14306 and M-26-15 require agencies to support TLS 1.3 by 2 January 2030. The 2035 completion target set by National Security Memorandum 10 still stands. Dustin Moody, who leads NIST’s PQC standardisation work, told Help Net Security there is “not one strategy that fits all use cases”.

The technical picture

The report lists every quantum-vulnerable algorithm in NIST’s current standards and names its replacement. For digital signatures, ECDSA, EdDSA and RSA under FIPS 186 are deprecated after 2030 and disallowed after 2035. The replacements are ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), with stateful LMS and XMSS reserved for niches such as firmware signing.

For key establishment, the Diffie-Hellman and MQV schemes in SP 800-56A and RSA key transport in SP 800-56B follow the same 2030 and 2035 schedule. Today ML-KEM (FIPS 203) is the sole approved quantum-resistant option, with ML-KEM-768 the recommended default and HQC chosen as a future alternative.

The report allows hybrid key establishment. A composite scheme can still be validated under FIPS 140 if at least one of its inputs comes from an approved scheme, even where another input is disallowed. That lets vendors pair ML-KEM with classical elliptic curve Diffie-Hellman during the transition without losing certification. Symmetric cryptography is largely unaffected. AES, SHA-2, SHA-3 and Ascon all stay approved, but the few symmetric standards at the 112-bit level will be disallowed in 2030.

NIST’s reasoning is the “harvest now, decrypt later” threat: an adversary records encrypted traffic today and decrypts it once a cryptographically relevant quantum computer exists. Signatures are not exposed in the same way, which helps explain why the federal key exchange deadline comes a year earlier.

Timeline of post-quantum migration milestones from 2028 to 2035 combining NCSC and NIST deadlines

Why it matters for UK organisations

NIST has no authority over UK organisations, but its decisions spread through the products UK organisations buy. Many cryptographic libraries, HSMs, PKI platforms and network appliances sold in the UK are built for FIPS 140 validation, and vendors follow NIST’s deprecation tables when deciding what to ship and when to remove legacy options.

The dates also line up closely with the UK’s own guidance. The NCSC’s Timelines for migration to post-quantum cryptography sets three milestones. By 2028, organisations should define their migration goals, complete a full discovery exercise and draw up an initial plan. By 2031, they should finish their highest-priority migrations and refine the plan into a full roadmap. By 2035, every system, service and product should be migrated. The NCSC guidance is written for large organisations, critical national infrastructure operators including industrial control systems, and firms with bespoke IT. SMEs on commodity technology should largely receive the change through vendor updates.

With NIST’s final report out, the period after 2030 becomes one of steadily rising risk for anyone still relying on RSA or elliptic curve key exchange. UK suppliers selling into US federal supply chains face a harder deadline, because their customers’ high-impact systems must move by the end of 2030. Regulated UK firms may well find auditors starting to ask about cryptographic inventories.

Expert view

In my experience, the hardest part of any cryptographic change is finding where the algorithms actually sit, not swapping them. When we test large estates, we routinely find RSA keys embedded in appliances nobody owns, certificates issued by internal CAs that nobody documented, and VPN concentrators running firmware years out of date. The NCSC’s 2028 discovery milestone is the one that matters most, and it is already close given typical budget and procurement cycles.

Deprecating every approved strength after 2030 is the right decision. It ends the comfortable assumption that moving from RSA-2048 to RSA-3072 or P-384 buys another decade. Allowing hybrid modes under FIPS 140 is also sensible, because it lets cautious organisations deploy ML-KEM now while keeping a classical safety net in case of implementation flaws in the newer schemes.

My one caution is that “disallowed after 2035” is a standards milestone, not a vendor promise. Long-lived operational technology, smart cards and embedded devices bought in 2027 may still be running in 2040. If procurement does not ask about post-quantum support now, organisations will be buying equipment that cannot be fixed later.

What to do now

  1. Start the cryptographic discovery exercise. Map where public-key cryptography is used across TLS endpoints, VPNs, SSH, code signing, PKI, HSMs, identity providers and OT. Link it to your asset register, as the Cyber Essentials secure configuration and security update management controls already require you to know what you run.
  2. Rank systems by data lifetime. Anything that protects data that must stay confidential beyond about 2035 should move to post-quantum key exchange first, because of harvest now, decrypt later.
  3. Get TLS 1.3 everywhere. It is the foundation for hybrid ML-KEM key exchange.
  4. Write PQC into procurement. Ask vendors for roadmaps covering ML-KEM, ML-DSA and hybrid modes, firmware update paths and FIPS 140 validation status, particularly for HSMs, network appliances and long-lived OT.
  5. Check your managed service providers. The NCSC expects providers to carry out the same discovery work on the services they run for you. Make this a contractual requirement.
  6. Brief the board against the NCSC dates. Present 2028, 2031 and 2035 as funded programme milestones, budgeting for discovery as well as replacement.

Bottom line

The final IR 8547 removes the last uncertainty about when classical public-key cryptography stops being acceptable. RSA and elliptic curve algorithms are in managed decline from 2030 and out from 2035, at every key size. For UK organisations the NIST timetable and the NCSC’s milestones now say the same thing. The most urgent task is the 2028 discovery exercise, and organisations that have not started it should begin this quarter.

Sources

Related Posts