On 1 January 2014, 1,024-bit RSA keys stopped being acceptable for generating digital signatures in US federal systems. NIST had announced the cut-off three years earlier in SP 800-131A, published in January 2011, and vendors, certificate authorities and agency IT shops spent those years replacing keys, re-issuing certificates and re-validating modules. NIST has retired cryptography the same way ever since, through a status word and a year in a transition table.
On 27 October 2026 NIST published the next table. The final version of NIST IR 8547, Transition to Post-Quantum Cryptography Standards, replaces the initial public draft of 12 November 2024. Its announcement calls the report NIST's "high-level road map" for moving to the post-quantum standards released in August 2024. Read against the draft, the final makes one structural change that reaches far beyond federal agencies: it pulls the 128-bit keys that protect most of today's internet into the same 2030 deprecation as the weaker 112-bit keys.
Practical takeaway. Under the final IR 8547, ECDSA on P-256, RSA-3072, Ed25519 and the matching key-establishment schemes are deprecated after 2030 and disallowed after 2035 under NIST standards and guidelines. The 2024 draft had left those 128-bit keys fully acceptable until 2035. For federal high value assets and high impact systems, the earlier deadlines of OMB M-26-15 apply in addition: post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031.
Which keys moved: P-256, RSA-3072 and Ed25519 join RSA-2048 in the 2030 deprecation
The draft's tables split quantum-vulnerable algorithms by strength. ECDSA and RSA at 112 bits of security, which in practice means RSA-2048, were "deprecated after 2030" and "disallowed after 2035". ECDSA and RSA at 128 bits or more, and EdDSA, which the draft listed only at 128 bits or more, carried a single entry: "disallowed after 2035". The finite-field and elliptic-curve Diffie-Hellman, MQV and RSA key-establishment tables followed the same pattern.
The final collapses the split. The ECDSA and RSA rows now read "≥ 112 bits of classical security strength", the EdDSA row "≥ 128 bits", and every row, along with each key-establishment row, is deprecated after 2030 and disallowed after 2035. The text gives the reasoning directly. NIST's long-term plan in SP 800-57 Part 1 had projected disallowing 112-bit public-key schemes on 1 January 2031; "based on the need to migrate to quantum-resistant algorithms during this time frame, NIST will instead deprecate all quantum-vulnerable digital signature algorithms after 2030 and disallow their use under NIST standards and guidelines after 2035." For key establishment the report repeats the rule and adds that application-specific guidance "may require or recommend migration" earlier, because of harvest-now, decrypt-later collection.
The practical reach is wide. ECDSA on P-256 and RSA carry most of the web's TLS certificates, Ed25519 is the default key type in much of SSH and software signing, and RSA-3072 is the common upgrade path for organizations that left RSA-2048 behind. Quentir noted in September that the factoring of RSA-260 did not move NIST's RSA-2048 dates. The final report leaves those dates in place too, and moves the stronger classical keys up to meet them.
What "deprecated" and "disallowed" mean under SP 800-131A after 2030 and 2035
The two words carry specific meanings in SP 800-131A, which IR 8547 quotes. A deprecated algorithm "may be used, but there is some security risk"; the data owner "must examine this risk potential and decide whether to continue." A disallowed algorithm is "no longer allowed for the stated purpose." A third status, legacy use, permits only processing of already protected information, such as verifying an old signature or decrypting stored ciphertext.
Deprecation shifts the decision to the data owner. From 2031, a system that has to follow NIST guidance, such as a federal system or a contractor system whose contract incorporates SP 800-131A, will be running P-256 or RSA-3072 as a deprecated algorithm, and under SP 800-131A its data owner decides whether to accept that risk. Whether a private organization is bound at all depends on its own contracts, regulators and certificate policies. The Cryptographic Module Validation Program laboratories, which the report lists among its audience, are the place where the status word turns into a product consequence. NIST also says it will revise SP 800-131A "with more detailed guidelines and schedules", so the operative dates for each application will arrive in further documents.
Why federal high value assets keep the deadlines of 31 December 2030 and 31 December 2031
The final report is written around two instruments the draft could not cite: Executive Order 14412 of 22 June 2026, "Securing the Nation Against Advanced Cryptographic Attacks", and OMB Memorandum M-26-15 of 24 June 2026, "Execution of the Migration to Post-Quantum Cryptography". National Security Memorandum 10 of May 2022 set 2035 as the target for the whole federal migration, and the report says that goal remains. Under M-26-15, high value assets and high impact systems, meaning systems with at least one FIPS 199 security objective rated "high", must adopt post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. Systems holding data expected to remain mission-sensitive in 2030 get the same priority.
NIST is explicit that its own schedule does not soften those dates. The 2030 to 2035 window "accommodates lower-risk systems and applications with legacy constraints," and "does not alter the earlier deadlines" for the high-sensitivity systems. Systems that cannot support post-quantum cryptography "should be identified and prioritized for replacement or decommissioning." The report measures the challenge against history: earlier cryptographic transitions took 10 to 20 years from standard to full deployment, and these deadlines, it says, "leave little margin."
What the final adds on ML-KEM-768, HQC, hybrid FIPS validation and TLS 1.3 by 2 January 2030
Four technical points are new or firmer than in 2024. NIST now recommends ML-KEM-768 as the default parameter set, "a large security margin at a reasonable performance cost." HQC, selected in March 2025 after the draft appeared, appears as the alternative key-establishment scheme that becomes approved once its standard is published, and NIST "has no current plans to select any additional KEMs." On hybrids, the report states that an approved composite key-establishment technique can be FIPS 140 validated "as long as at least one of the inputs" comes from an approved scheme, "even if other inputs are disallowed", and that SP 800-56C will be updated to allow either ordering of the shared secrets. That sentence matters for every vendor shipping ML-KEM combined with X25519 in TLS.
The fourth point is the protocol clock. Agencies must support TLS 1.3 no later than 2 January 2030 under Executive Order 14306 and M-26-15, and NIST describes TLS 1.3 as "a practical near-term path to quantum-resistant key establishment", with guidance to follow in the next revision of SP 800-52. On the symmetric side, the remaining 112-bit primitives "will be disallowed in 2030", and the lightweight Ascon family now appears in the approved tables. The report also names the hardest case it sees: Personal Identity Verification credentials, whose cards, readers, middleware and issuing systems all need updating on multi-year replacement cycles, the same problem the Pentagon's PQC director described for PIV and CAC smart cards in October.
How Quentir Reads It
The final IR 8547 turns a debate about when RSA-2048 retires into a statement about every classical public key. Outside the federal government the report binds no one directly. Its status words reach private systems wherever a contract, a FIPS 140 validation requirement, a supervisor's guidance or a certificate policy refers to NIST standards, and that reach differs from instrument to instrument. Where it applies, a P-256 certificate after 2030 will carry the same formal status as an RSA-2048 one, and the data owner who keeps it in service carries the risk decision. That moves the question from security teams into contracts, audit files and product roadmaps, and it moves it there for hospitals, banks and utilities whose systems will outlive 2030 as much as for agencies.
The open point is pace, and it sits in the application-specific revisions. NIST has promised revisions of SP 800-131A, SP 800-52 and SP 800-56C, and each can set earlier, application-specific dates, starting with key establishment in TLS and IKE. Those documents, more than the 2035 headline, will decide when a deprecated key becomes a problem in practice. Quentir's Signature Report No. 2, the PQC Migration Roadmap, is the paid edition that turns transition dates of this kind into a migration plan.
Sources: NIST, NIST IR 8547, Transition to Post-Quantum Cryptography Standards (Final), D. Moody, R. Perlner, A. Regenscheid, A. Robinson and D. Cooper, October 2026, document history final 27 October 2026, PDF, doi:10.6028/NIST.IR.8547; NIST, NIST IR 8547 initial public draft, 12 November 2024; NIST News, NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards, 27 October 2026; Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, DCPD-202600417, 22 June 2026; Office of Management and Budget, Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography, 24 June 2026; National Security Memorandum 10, 4 May 2022; Executive Order 14306, 6 June 2025; NIST SP 800-131A (January 2011 and later revisions). Report text, tables and definitions read from the final PDF and compared with the draft PDF on 28 October 2026.
Published intelligence, built to inform your own decisions. Published: October 28, 2026.