The U.S. National Institute of Standards and Technology (NIST) published the final version of NIST Internal Report (IR) 8547, “Transition to Post-Quantum Cryptography Standards,” on October 27, 2026. In it, NIST deprecates RSA, elliptic-curve, and finite-field Diffie-Hellman cryptography at every approved key size after 2030 and disallows those algorithms under its standards after 2035.
NIST withdrew the initial public draft of November 12, 2024, on the same day. In the draft, NIST had applied the 2030 deprecation only to 112-bit parameter sets such as RSA-2048 and the P-224 curve. Stronger parameters, including RSA-3072, the P-256 curve, and Ed25519, were to stay acceptable until their disallowance after 2035.
Organizations that follow NIST can keep RSA-3072 or P-256 in service after 2030 only as deprecated algorithms. Under NIST’s definitions, a deprecated algorithm may still be used, but the data owner must examine the security risk and decide whether to continue. A disallowed algorithm may no longer be used for the purpose in question.
Federal deadlines
NIST rewrote the report around Executive Order 14412, which President Donald Trump signed on June 22, 2026, and around memorandum M-26-15, which the White House Office of Management and Budget (OMB) issued two days later. Under those directives, federal agencies must move high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030, and to post-quantum digital signatures by December 31, 2031.
NIST wrote that the period between 2030 and 2035 is meant for lower-risk systems and for applications with legacy constraints, and that federal agencies must still meet the earlier deadlines. OMB excluded national security systems from M-26-15. Those systems follow separate requirements, including the National Security Agency’s CNSA 2.0 algorithm suite.
“We understand there’s not one strategy that fits all use cases,” Dustin Moody, the NIST mathematician who leads the agency’s post-quantum standardization project, said in NIST’s announcement.
Hybrid key exchange after 2035
NIST also set out how it will treat hybrid key establishment. A hybrid combines a classical algorithm with a post-quantum one such as ML-KEM, the key-encapsulation mechanism NIST standardized from CRYSTALS-Kyber. The agency wrote that the combination technique in Special Publication (SP) 800-56C remains allowed even when one input comes from a disallowed algorithm.
A hybrid with at least one input from an approved scheme can be validated under FIPS 140, NIST’s Federal Information Processing Standard for cryptographic modules, even if its other inputs are disallowed. NIST said it will update SP 800-56C to permit combining the two shared secrets in either order.
The most widely deployed hybrid, X25519MLKEM768, combines ML-KEM with X25519, a key-agreement scheme that NIST has said it does not propose to approve. Chrome and Firefox offer it by default for TLS connections. Apple’s iOS 26 and macOS 26 also use it by default.
Other changes in the final report
In the final report, NIST also:
- named HQC, a code-based key-encapsulation mechanism, as the alternative to ML-KEM, with a Federal Information Processing Standard under development
- said it has no current plans to select further key-encapsulation mechanisms
- recommended ML-KEM-768 as the default ML-KEM parameter set
- said guidance on hybrid key exchange in TLS will come in the next revision of SP 800-52
- said the stateful hash-based signature schemes LMS and XMSS are not intended for general use but may be useful for software and firmware signing
NIST said it is revising the processes of its Cryptographic Module Validation Program, as Executive Order 14412 directed. It asked hardware vendors to begin integrating post-quantum algorithms immediately, citing the long lead times for chip design and fabrication.
What remains open
NIST has not yet published the FIPS standards for HQC or for FN-DSA, the signature scheme derived from FALCON. It has not announced a date for the SP 800-52 revision.
For hybrid signatures, NIST repeated the draft’s position that its standards accommodate dual signatures if at least one component is NIST-approved, and added a caution that the security properties of such signatures need careful analysis. It specified no encoding or binding mechanism for them.
The comments NIST received on the draft before the comment period closed on January 10, 2025, came from companies including Bosch, IDEMIA, Infineon, Intel, and Thales, from the wireless industry association CTIA, and from individual cryptographers.
For federal priority systems, the binding dates remain December 31, 2030, for key establishment and December 31, 2031, for signatures. For other systems that follow NIST, the RSA, elliptic-curve, and finite-field Diffie-Hellman schemes it approves today are deprecated after 2030 and disallowed after 2035. In Europe, Germany’s federal government recommended the end of 2030 as the date for moving high-risk systems in a national migration guideline published on October 12.
