The National Institute of Standards and Technology (NIST) has issued its final technical transition roadmap, NIST IR 8547: “Transition to Post-Quantum Cryptography Standards”. Authored by the Computer Security Division‘s leadership team—Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson, and David Cooper—the milestone document provides federal agencies, commercial enterprises, and global standard-setting bodies with the official blueprint and deprecation timeline for phasing out classical public-key cryptography.
The report operationalizes the requirements of White House Executive Order 14412 and OMB Memorandum M-26-15. Under this policy framework, federal High Value Assets (HVAs) and high-impact systems face accelerated, binding deadlines: complete transition to post-quantum cryptography (PQC) for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. Across the broader IT ecosystem, NIST officially confirms that classical, quantum-vulnerable public-key algorithms will be deprecated after 2030 and completely disallowed after 2035.
| [ NIST IR 8547: Cryptographic Migration & Deprecation Framework ] | ||
|---|---|---|
| Cryptographic Mechanism | Quantum-Vulnerable Standards | PQC Target Standards & Enforceable Status |
| • Key Establishment / KEM | • RSA (SP 800-56B) • DH & ECDH (SP 800-56A) | • ML-KEM (FIPS 203) [Default: ML-KEM-768]; HQC (under development). • Federal HVA Deadline: Dec 31, 2030 • Deprecated: 2031–2035; Disallowed: Dec 31, 2035. |
| • General Digital Signatures | • RSA (FIPS 186) • ECDSA (FIPS 186) • EdDSA (FIPS 186) | • ML-DSA (FIPS 204) & SLH-DSA (FIPS 205); FN-DSA (under development). • Federal HVA Deadline: Dec 31, 2031 • Deprecated: 2031–2035; Disallowed: Dec 31, 2035. |
| • Stateful Signatures | • N/A (Specialized use) | • LMS, HSS, XMSS, XMSSMT (SP 800-208). • Approved strictly for software, firmware, and secure boot signing due to state-tracking operational overhead. |
| • Composite / Hybrid Modes | • Legacy Asymmetric Primitives | • SP 800-56C & SP 800-227: Allows combining PQC and classical secrets (Z’ = Z ∥ T) and dual signatures under FIPS 140 validation. |
| • Symmetric Ciphers & Hash | • 112-bit legacy primitives (Disallowed after 2030) | • AES-128/192/256 (FIPS 197), SHA-2/SHA-3, and Ascon (SP 800-232) meet Category 1–5 quantum-resistant criteria; remain approved. |
Addressing the Asymmetry of Cryptographic Threat Horizons
NIST IR 8547 anchors its urgency directly upon Mosca’s theorem and the persistent risk of “Harvest Now, Decrypt Later” (HNDL) attacks. Because adversarial intelligence agencies routinely siphon encrypted traffic from public networks with the intention of decrypting it once cryptanalytically relevant quantum computers (CRQCs) mature, data confidentiality requires immediate mitigation.
The report establishes clear differentiation between key agreement and digital signatures:
- Key Encapsulation Mechanisms (Immediate Priority): Because intercepted ciphertext cannot be re-encrypted retroactively, interactive protocol endpoints like Transport Layer Security (TLS) and Internet Key Exchange (IKE) require early intervention. NIST mandates that federal agencies enforce TLS version 1.3 by January 2, 2030, while advising that hybrid key-exchange mechanisms pairing ML-KEM with classical Diffie-Hellman be deployed immediately.
- Digital Signatures (Complexity Priority): While signatures are inherently immune to HNDL collection (authenticity is evaluated at the time of signing), replacing PKI certificates, root certificate authorities (CAs), Personal Identity Verification (PIV) smart cards, and hardware security modules (HSMs) presents systemic logistical frictions that historically demand decade-long conversion cycles.
Official Approval of Hybrid Schemes in FIPS 140 Validations
Addressing industry concerns regarding regulatory compliance during the multi-year transition, NIST confirmed structural updates to SP 800-56C (Key-Derivation Methods) and SP 800-227 (Recommendations for KEMs). NIST explicitly accommodates composite/hybrid key establishment: an approved post-quantum shared secret (such as that generated by ML-KEM) can be concatenated with a classical shared secret (such as ECDH) into a composite string (Z’ = Z ∥ T or T ∥ Z) without invalidating FIPS 140 cryptographic module validation, even if one input originates from an unapproved or legacy algorithm.
Similarly, NIST guidelines accommodate dual signatures—generating composite signatures combining classical and quantum-resistant algorithms across digital certificates and software binaries—provided at least one component algorithm is NIST-approved.
Enterprise Execution: Commercial Software Tooling Takes Center Stage
The release of NIST IR 8547 serves as the formal regulatory trigger for the commercial enterprise software sector. Coinciding with NIST’s publication, major infrastructure vendors have begun rolling out dedicated migration management suites—evidenced by IBM’s launch of its unified ‘IBM Quantum Safe’ suite at IBM TechXchange—designed to automate the discovery of cryptographic artifacts, generate Cryptography Bills of Materials (CBOMs), and mediate hybrid traffic across legacy networks.
As the Cryptographic Module Validation Program (CMVP) accelerates validation queues for native FIPS 203, 204, and 205 implementations, the transition from algorithmic standard-setting to operational enterprise compliance is now officially underway.
Read the complete technical transition publication via the NIST IR 8547 Official Portal here, and review the companion implementation resources on the NCCoE Migration to PQC Project Page here.
In GQI Portal
The players behind the news
The team that writes QCR tracks every company, deal and technology in the GQI Factory, GQI's verified database of the quantum industry. Next up: every story linked to its players, coming to QCR's paid plans.
- Players Companies and institutions across the quantum industry, by segment.
- Scorecards How the players compare on hardware, software, funding and more.
Newsletter
QCR Alerts in your inbox
The latest reporting and analysis from Quantum Computing Report. Free, unsubscribe any time.