NIST released initial working drafts of three documents on June 12, 2026, with proposed post-quantum cryptography updates to its Personal Identity Verification (PIV) standards. PIV is the federal standard for the identity credentials that the government issues to its employees and contractors and uses to check who may enter federal facilities and information systems.
NIST wrote that the drafts “identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.” NIST published ML-DSA and ML-KEM, formerly CRYSTALS-Dilithium and CRYSTALS-Kyber, as FIPS 204 and FIPS 203 in August 2024. With a key-encapsulation mechanism, two parties can establish a shared secret key over an open network.
NIST proposes keeping today’s classical PIV keys and adding separate post-quantum keys beside them, and it is collecting comments now on drafts it describes as preliminary.
What the drafts cover
NIST posted drafts of Special Publication (SP) 800-73-6 Part 1 and Part 2, on how the PIV card application organizes its data and on the commands that client software sends to it. It also posted a draft of SP 800-78-6, on cryptographic algorithms and key sizes for PIV. NIST added a PQC Overview with what it called “a working gap analysis of the specification changes.”
NIST wrote that its approach “centers on a dual-stack model that preserves existing classical PIV keys and data objects.” Under that model, NIST would add new key references, certificate containers, and data objects for post-quantum credentials. NIST described the design as one that “supports backward compatibility and incremental deployment during the transition.”
On a PIV card, a key reference is the identifier that client software sends to select a particular key. Certificate containers and data objects are the card’s storage slots for certificates and other credential data.
How NIST is taking comments
NIST called the documents “preliminary working materials, not formal public drafts.” NIST added that it “welcomes feedback throughout the development process.” On its publication page for each draft, NIST lists the comment period as ongoing, with no closing date.
Reviewers can join a public mailing list, [email protected], or open issues and pull requests in the project’s GitHub repository. By comparison, NIST set January 10, 2025, as the comment deadline for the November 2024 initial public draft of its post-quantum transition plan, NIST IR 8547.
Transition dates
In that 2024 draft, NIST proposed deprecating quantum-vulnerable algorithms such as RSA and the elliptic-curve schemes ECDSA and ECDH at the 112-bit security level after 2030. It proposed disallowing them at every security level after 2035. In NIST’s terms, a deprecated algorithm may still be used with some security risk, while a disallowed one is no longer allowed.
In the same draft, NIST named FIPS 201-3 and its supporting Special Publications as the standards for PIV. NIST wrote that it would revise its documents during the migration “to provide more detailed guidelines for deprecating quantum-vulnerable algorithms, tailored to relevant applications.”
Under the current PIV algorithm standard, SP 800-78-5, a card’s authentication and signature keys can be RSA keys of 2048 or 3072 bits or elliptic-curve keys on the P-256 or P-384 curves. NIST limited RSA to 3072-bit keys from 2031 in that standard. When NIST published it in July 2024, the agency wrote that post-quantum algorithms “will be specified in a future revision of this document.”
NIST gave no date in its June announcement for formal public drafts of that revision.
Update, November 13, 2026: NIST published the final IR 8547 on October 27. NIST wrote that it “will instead deprecate all quantum-vulnerable digital signature algorithms after 2030.” It marked RSA, ECDSA and ECDH at 112 bits and above as deprecated after 2030 and disallowed after 2035.
