NIST finalises its post-quantum plan, deprecating RSA and ECC after 2030

[Echo36]

The timeline for moving away from today's encryption has just got firmer. PostQuantum reports that NIST has published the final version of its report on the transition to post-quantum cryptography standards, known as NIST IR 8547, and withdrawn the earlier 2024 draft

The biggest change is stricter dates. The draft would have kept stronger classical algorithms such as P-256, RSA-3072 and Ed25519 acceptable until 2035. The final version deprecates RSA, ECDSA and EdDSA signatures at every approved strength after 2030, and the same goes for classical key establishment methods such as Diffie-Hellman and RSA. All of them become disallowed after 2035

In NIST's language, deprecated means you can still use something but must accept and assess the risk yourself, while disallowed means it is no longer permitted. The report is aligned with recent US federal deadlines, including moving high value systems to post-quantum key establishment by the end of 2030 and post-quantum signatures by the end of 2031

There are other updates too. HQC is confirmed as an alternative key encapsulation method, with ML-KEM-768 recommended as the default, TLS is named as an early priority, and the lightweight Ascon cipher is added. Hybrid key establishment remains allowed as long as one part uses an approved method such as ML-KEM. NIST's Dustin Moody said there is not one strategy that fits all use cases, and the agency received 25 formal comments, including from Bosch, Ericsson, Intel and Thales

This matters well beyond the US government, because NIST's guidance shapes what vendors and other countries do. Bringing the deadline forward to 2030 for most uses gives organisations less time than many expected. Anyone who has not started a cryptography inventory should start now

Is a 2030 deadline realistic for most organisations? And how far along is your workplace with post-quantum planning?

NIST IR 8547 Final: What Changed From the Draftpostquantum.com