NIST's Final IR 8547 of 27 October 2026 Deprecates P-256, RSA-3072 and Ed25519 After 2030, Where the 2024 Draft Left 128-Bit Keys Untouched Until 2035
What NIST changed in the final IR 8547 on 27 October 2026
NIST published the final version of NIST IR 8547, Transition to Post-Quantum Cryptography Standards, on 27 October 2026, replacing the initial public draft of 12 November 2024. The central change sits in the transition tables. The draft deprecated only quantum-vulnerable algorithms at 112 bits of security after 2030 and let stronger keys run until they were disallowed after 2035. The final deprecates every quantum-vulnerable public-key algorithm at 112 bits or more after 2030, so ECDSA on P-256, RSA-3072 and Ed25519 now enter the deprecated category at the same point as RSA-2048. Disallowance after 2035 stays where it was.
How the final ties NIST standards to EO 14412 and OMB M-26-15
The report now cites Executive Order 14412 of 22 June 2026 and OMB Memorandum M-26-15 of 24 June 2026. Under them, federal high value assets and high impact systems must use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031, and agencies must support TLS 1.3 by 2 January 2030. NIST says the 2030 to 2035 window exists for lower-risk and legacy systems and does not relax those deadlines. The final also names ML-KEM-768 as the default parameter set, confirms HQC as the second key-establishment scheme and states that an approved composite, or hybrid, key-establishment technique can be FIPS 140 validated when at least one of its inputs comes from an approved scheme.
What the UK-Singapore Financial Dialogue Joint Statement of 20 October 2026 Says About Post-Quantum Cryptography, QKD and Bank Supervisors
What HM Treasury and MAS published after the 20 October 2026 dialogue
On 20 October 2026 the United Kingdom and Singapore held their 11th Financial Dialogue in Singapore, with officials from HM Treasury and the Monetary Authority of Singapore joined by the Bank of England and the Financial Conduct Authority. The joint statement HM Treasury published the same day runs to roughly a thousand words across digital finance, capital markets, sustainable finance and the two countries' 2027 roles at the G20 and in ASEAN. Quantum technology takes one sentence. It says the exchange covered each side's approach to quantum security and to supervisory expectations for financial institutions moving to quantum-safe technology, including the NCSC's post-quantum cryptography migration guidance and lessons from MAS's quantum key distribution sandbox.
Why the two references in that sentence point in different directions
Some trade coverage described the meeting as an agreement on joint oversight and unified standards. The statement contains no such commitment. Its interest lies in the pairing. The NCSC sets 2028, 2031 and 2035 as its migration milestones and says it will not support quantum key distribution for government or military use. MAS has tested QKD with four banks and reported both its potential and its limits. This post reads the sentence closely and asks what a bank supervised in both London and Singapore can take from it.
The SEC's Fiscal Year 2027 Examination Priorities List Quantum Computing Under Regulation SCI: What the 23 October 2026 Sentence Means for Exchanges and Clearing Agencies
What the SEC published on 23 October 2026
On 23 October 2026 the US Securities and Exchange Commission released the Division of Examinations' priorities for fiscal year 2027. In the section on Regulation Systems Compliance and Integrity, the rule that governs the core technology of exchanges, clearing agencies, FINRA and a few other market utilities, the Division says its examinations "will focus on emerging trends, including SI, tokenization of securities, extended trading hours, and quantum computing." Neither the fiscal 2025 nor the fiscal 2026 priorities mentioned quantum computing at all.
What the Regulation SCI sentence requires of exchanges and clearing agencies
Several outlets reported that the SEC is now targeting quantum computing. The document is narrower. It names no algorithm, sets no migration date and asks for no inventory, and its own disclaimer says it is a staff statement with no legal force. The weight comes from the rule it sits under. Regulation SCI already requires each covered entity to keep written policies that give its systems adequate security, and to review and test those systems for vulnerabilities to internal and external threats. An examiner who asks how a clearing agency is preparing for post-quantum cryptography can now point to a published priority when asking. This post compares what was reported with what the text says, and asks what an SCI entity can expect to be asked in the coming fiscal year.
Germany's Post-Quantum Guideline From BMI, BMDS and BSI, Published 12 October 2026: Crypto Inventories by End-2026, High-Risk Systems by 2030, and the Legal Weight of BSI Act Section 30
What BMI, BMDS and BSI published on 12 October 2026
Germany's Federal Ministry of the Interior (BMI), its Federal Ministry for Digital Transformation and Government Modernisation (BMDS) and the Federal Office for Information Security (BSI) have jointly published a ten-page guideline on the national implementation of the EU roadmap for the transition to post-quantum cryptography. It addresses federal, state and municipal administrations, companies and operators of critical infrastructure. High-risk use cases should move to quantum-safe cryptography by the end of 2030, and medium-risk use cases by the end of 2035. By the end of 2026 every organization should have completed an initial cryptographic inventory, named a responsible office and started the first migration steps.
Why the German timetable is guidance with a legal edge
The guideline calls its deadlines urgent recommendations and asks Germany's IT Planning Council and the critical-infrastructure partnership UP KRITIS to make them binding by the end of 2026. It also points to section 30 of the BSI Act, which requires important and particularly important entities under the NIS2 regime to take security measures that meet the state of the art, including concepts for the use of cryptography. The guideline places post-quantum cryptography under that heading, recommends hybrid schemes, and asks that procurement treat crypto-agility as a default requirement. This post follows the dates from 1994 to 2035 and marks where each one carries legal force.
Prof. Mauritz Kop Speaks at Quantum Innovation 2026 in Nagoya, Japan, With Elham Kashefi, Dorit Aharonov, and Google Quantum AI
Prof. Mauritz Kop, founder of the Stanford Center for Responsible Quantum Technology and of Quentir, speaks at Quantum Innovation 2026 in Nagoya, the International Symposium on Quantum Science, Technology and Innovation organized by Japan's Quantum Technology Innovation Hubs from December 8 to 11, 2026. His talk, Before Q-Day: Responsible Quantum Innovation, Standards, and the Post-Quantum Transition, closes the Practical Quantum Computing session on December 8, and he will also visit a quantum computer in Japan with the delegation.
Japan's Quantum Ecosystem in One Program
Co-organized by the Cabinet Office, three ministries, JST, RIKEN, AIST, NICT, Q-STAR, and leading universities, and sponsored by Fujitsu, Toyota, Toshiba, and Hitachi, the symposium brings keynotes by Dorit Aharonov, Amir Yacoby, and Hoi-Kwong Lo and invited talks by Elham Kashefi and leaders from Google Quantum AI, IonQ, Intel, the Weizmann Institute, the University of Toronto, and RIKEN.
Standards, Assurance, and Allied Cooperation
After two talks on quantum cryptanalysis, Kop closes the session from 5:40 to 6:10 PM Japan time with a talk on responsible quantum innovation, standards, and the post-quantum migration. Our article also profiles Japan's quantum hardware at RIKEN, Fujitsu, Quantinuum, and IBM, the industrial setting of Nagoya, and Japan Quantum Week.
Prof. Mauritz Kop Invited to the Inaugural ACM PQQS 2026 in Silicon Valley, With Turing Award Laureate Charles Bennett, Dan Boneh, and Google Quantum AI's Ryan Babbush
Prof. Mauritz Kop, Founder of the Stanford Center for Responsible Quantum Technology and of Quentir, has been invited to speak at ACM PQQS 2026, where Turing Award laureate Charles Bennett of IBM Research also gives a keynote. The first ACM Conference on Post-Quantum and Quantum-based Security runs from November 2 to 4, 2026 in Silicon Valley near San Jose. The program lists his affiliations at CIGI and the U.S. Air Force Academy, and his talk is titled The Race to Quantum First: Building a Secure and Responsible Quantum Future.
A New ACM Venue for Quantum-Era Security
ACM's security community built PQQS as a new annual forum for post-quantum cryptography, quantum cryptography, and the security of quantum computing systems. The program combines twenty-six peer-reviewed papers with keynotes by Charles Bennett of IBM Research, Stanford's Dan Boneh, Google Quantum AI's Ryan Babbush, ETH Zurich's Renato Renner, and Cisco Research's Ramana Kompella, invited talks by Bart Preneel, Reza Nejabati, Vipul Goyal, Yevgeniy Dodis, and J.R. Rao, and a panel with Dustin Moody, who leads the NIST post-quantum cryptography project, and Michele Mosca.
Kop's Talk: Procurement, the LSI Test, and Allied Coalition Scale
Kop's talk treats the race to quantum first as a contest for power and proposes a governance agenda that makes responsible innovation an instrument of strategic leadership: public procurement that accelerates post-quantum adoption, the LSI test for security measures, a hospital example for critical infrastructure, coalition scale among allies, and a European Quantum Act architecture. It builds on Stanford RQT's foundational work and on his War on the Rocks essays read across the U.S. national security community.
ML-KEM Has Moved Into the Hardware Test Lab
The standard is now a device
Post-quantum cryptography has crossed an awkward threshold. ML-KEM is no longer only a standards document, a migration milestone or a line item in a crypto-agility plan. Once it lands in hardware, firmware and embedded libraries, its security also depends on power traces, electromagnetic leakage and the exact sequence of operations during decapsulation. A new 30 June 2026 arXiv paper on Fujisaki-Okamoto verification in ML-KEM makes that point concrete: the verification step can become a visible leakage surface during physical side-channel analysis.
Why procurement changes
The useful commercial lesson is narrow and important. Buyers should not treat ML-KEM implementation security as a checkbox created by adopting a NIST algorithm name. They need to know whether their chips, HSMs, gateways, telecom equipment, IoT modules and cloud cryptographic services have been tested against the way the algorithm runs in the real device. That moves post-quantum transition work closer to product assurance, certification, warranty drafting and supplier disclosure.
Quentir’s reading
This does not weaken the case for migration. It sharpens it. The next mature post-quantum program will connect algorithm selection with side-channel assurance, validated components, patch rights, test reports and contractual responsibility when a “quantum-safe” implementation leaks through the hardware layer. That is where policy deadlines become operational.
Quantum Deadlines Are Now a Supply-Chain Question
Two clocks now converge
The United States has joined two clocks that many organizations still treat separately: the race toward useful quantum computing and the migration away from vulnerable public-key cryptography. The June 2026 federal quantum actions point toward a scientifically useful fault-tolerant machine by 2028, while the same policy cycle pushes federal high-value assets and high-impact systems toward NIST-approved post-quantum cryptography by the 2030/2031 horizon. That combination changes the commercial question. It is no longer enough to ask when a system will be upgraded. Procurement teams, platform owners, telecom operators and cloud customers need to know which libraries, chips, certificates, export-control rules and supplier warranties sit underneath the upgrade path.
What changes for suppliers
The useful signal is the movement from policy language to post-quantum supply-chain governance. Validated cryptographic libraries, DOE’s Quantum Genesis push, BIS advanced-computing controls, UK ProQure, Canada’s National Quantum Strategy and China’s photonic quantum infrastructure all point in the same direction: cryptographic migration now depends on physical and jurisdictional infrastructure. For Quentir readers, the practical object is crypto-agility procurement: contracts, supplier attestations and product roadmaps that can absorb changing NIST standards without pretending that a single software patch solves the problem. The result is a cleaner question for every serious buyer: can each critical supplier show the path from today’s encryption stack to the validated post-quantum stack it will depend on tomorrow?
Federal PQC Is Becoming a Contractor Evidence Test
Federal post-quantum policy is no longer only a standards story. For boards, general counsel, procurement teams and security leaders, the June 2026 federal signal turns PQC migration into a dated evidence problem: which systems still depend on RSA or elliptic-curve cryptography, which suppliers control those systems, and what proof shows that rotation can happen before government and contractor expectations harden.
This Quentir brief reads the PQC timetable as a contractor evidence test. It explains why a useful board packet should include a cryptographic inventory, named migration owners, supplier flow-down questions, a crypto-bill-of-materials posture, tested rotation paths, vulnerability-disclosure expectations and an exception register. It also separates direct federal obligations from broader procurement influence, so private organizations can prepare without overstating legal exposure. The practical point is simple: a supplier saying it “supports PQC” is not the same as an auditable record showing which connection, certificate, library, credential or outsourced service was tested. Use this brief to frame the first board discussion, supplier questionnaire or procurement evidence request.