NIST IR 8547 puts dates on the end of RSA and elliptic curve cryptography, and those dates are already shaping what organisations can safely buy. The report, "Transition to Post-Quantum Cryptography Standards", was released by NIST as an Initial Public Draft (ipd) on 12 November 2024, with comments closing on 10 January 2025. When we checked the NIST CSRC page on 27 October 2026 it still listed only the draft, so treat every date here as NIST's stated intent rather than a final rule. This guide explains what the draft says, which algorithms it deprecates and disallows and when, how it treats hybrids and symmetric cryptography, and how to turn the timeline into inventory, procurement and evidence work. It is written for security architects, PKI and cryptography owners, and the people who write technology requirements into contracts. For the wider quantum risk picture, see the Q-Day Planning Guide; this page stays on the IR 8547 timeline itself.
Key takeaways
- Two dates matter: 2030 and 2035. In the draft, 112-bit quantum-vulnerable signatures and key establishment (for example RSA-2048 and ECC P-224 class keys) are deprecated after 2030, and all quantum-vulnerable public key algorithms, at any strength, are disallowed after 2035.
- It is still a draft. IR 8547 was an Initial Public Draft when checked on 27 October 2026; NIST said the comments would be used to revise the plan, so watch for a revised or final version before hard-coding dates into policy.
- Symmetric cryptography mostly stays. NIST does not expect a transition away from AES or SHA-2 and SHA-3 for quantum reasons; AES-128 and above meet at least security category 1, but some 112-bit symmetric uses face separate retirement.
- Key establishment comes first. The draft says interactive protocols such as TLS and IKE should prioritise post-quantum key establishment because of "harvest now, decrypt later" collection of traffic today.
- Hybrids are a bridge, not the destination. NIST accepts hybrid key establishment through SP 800-56C and dual or composite signatures where one component is approved, but expects a second move to post-quantum only later.
What it is and who it applies to
NIST IR 8547 is an Interagency or Internal Report, not a FIPS or a Special Publication. It does not itself mandate anything. Its job is to describe NIST's expected path from quantum-vulnerable public key algorithms to the post-quantum standards published in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), plus the stateful hash-based signatures in SP 800-208. The deprecation and disallowance dates it proposes will take legal effect for US federal systems through the documents that do carry weight, chiefly SP 800-131A (algorithm transitions), the SP 800-56 series (key establishment) and FIPS 140-3 module validation.
The report ties its end date to National Security Memorandum 10 (NSM-10), which set 2035 as the primary target for completing the federal migration, with the aim of mitigating as much quantum risk as is feasible by then. It also says some systems may need to move earlier.
| Audience | How IR 8547 reaches you | Practical effect |
|---|---|---|
| US federal agencies and their systems | Through SP 800-131A, SP 800-56A/B/C and FIPS 140-3 validation once revised | Algorithms become deprecated (allowed with accepted risk) and then disallowed |
| Vendors selling to the US government | FIPS 140-3 module validation and agency procurement requirements | Products need validated ML-KEM and ML-DSA support before buyers can stop using RSA and ECC |
| Regulated private sector (finance, health, critical infrastructure) | Indirectly, as regulators and auditors adopt NIST as the reference | Expect auditors to ask for a migration plan aligned to 2030 and 2035 |
| Organisations outside the US | Product roadmaps from global vendors; national guidance such as the UK NCSC timeline | Similar end dates: the NCSC targets full migration by 2035 |
The draft also catalogues application-specific standards that will need updating, including SP 800-52 Rev. 2 for TLS and FIPS 201-3 for PIV credentials, so the timeline flows down into protocol profiles and identity credentials as well as algorithms.
Structure and key requirements
The report has four main sections: an introduction (scope and audience), background on cryptographic standards and the technologies that use them, migration considerations (use cases and hybrid protocols), and "Towards a PQC Standards Transition Timeline", which holds the dates. The core of the draft is the transition table for quantum-vulnerable algorithms.
Quantum-vulnerable algorithms and proposed dates
| Algorithm family | Current standard | Security strength | Proposed transition (IR 8547 ipd) |
|---|---|---|---|
| ECDSA, EdDSA, RSA digital signatures | FIPS 186-5 | 112 bits | Deprecated after 2030, disallowed after 2035 |
| ECDSA, EdDSA, RSA digital signatures | FIPS 186-5 | 128 bits or more | Disallowed after 2035 |
| Finite field Diffie-Hellman and MQV | SP 800-56A | 112 bits | Deprecated after 2030, disallowed after 2035 |
| Finite field Diffie-Hellman and MQV | SP 800-56A | 128 bits or more | Disallowed after 2035 |
| Elliptic curve Diffie-Hellman and MQV | SP 800-56A | 112 bits | Deprecated after 2030, disallowed after 2035 |
| Elliptic curve Diffie-Hellman and MQV | SP 800-56A | 128 bits or more | Disallowed after 2035 |
| RSA key establishment | SP 800-56B | 112 bits | Deprecated after 2030, disallowed after 2035 |
| RSA key establishment | SP 800-56B | 128 bits or more | Disallowed after 2035 |
Deprecated in NIST terms means the algorithm may still be used but the user accepts risk; disallowed means it is no longer acceptable for the purpose. The draft is explicit that 112-bit classical schemes will be deprecated rather than disallowed in 2030 so organisations can keep running them during migration. In practice, RSA-2048 sits at 112 bits and RSA-3072 and P-256 sit at 128 bits, which is why an RSA-2048 signing key carries the earlier 2030 marker and a P-256 key does not.
Replacement algorithms
| Use | Standard | Parameter sets and NIST security category |
|---|---|---|
| Key encapsulation | FIPS 203 ML-KEM | ML-KEM-512 (category 1), ML-KEM-768 (category 3), ML-KEM-1024 (category 5) |
| General signatures | FIPS 204 ML-DSA | ML-DSA-44 (category 2), ML-DSA-65 (category 3), ML-DSA-87 (category 5) |
| Conservative hash-based signatures | FIPS 205 SLH-DSA | 128, 192 and 256-bit parameter sets (categories 1, 3, 5) |
| Stateful hash-based signatures (firmware, code signing) | SP 800-208 LMS/HSS, XMSS/XMSS^MT | Categories 3 and 5 |
The draft also anticipates a further FALCON-based signature FIPS. Our signature deep dive is in the ML-DSA and SLH-DSA Post-Quantum Signatures Guide.
Symmetric algorithms and hashes
NIST states it does not expect to transition away from its symmetric standards as part of the post-quantum migration. AES-128, AES-192 and AES-256 map to categories 1, 3 and 5. Symmetric primitives giving at least 128 bits of classical security are believed to meet category 1. Two caveats apply: some 112-bit symmetric uses are slated for disallowance in 2030 through the SP 800-131A revision, and SHA-1 has only 80-bit collision resistance, below category 1. The companion draft SP 800-131A Rev. 3 (ipd, October 2024) proposes moving from 112-bit to 128-bit minimum strength, retiring ECB for confidentiality and scheduling the retirement of SHA-1 and 224-bit hashes.
Hybrid schemes
The draft describes hybrids as combining a quantum-resistant and a quantum-vulnerable algorithm so the result stays secure if either holds. For key establishment, NIST already allows a composite approach under SP 800-56C and plans to update it to accept ML-KEM shared secrets; KEM guidance itself is now in SP 800-227, published final on 18 September 2025. For signatures, dual or composite signatures are acceptable when at least one component is NIST-approved, and NIST says FIPS 140 validation will accommodate hybrid modes. Each application owner decides whether the cost and complexity of a hybrid is justified. See the Hybrid Post-Quantum TLS Key Exchange Guide for the TLS specifics.
Identity and NHI requirements
IR 8547 is unusually direct about identity. Its use cases include code signing, user and machine authentication, network protocols, and email and document signing, and it states that PKI components must be able to issue and sign certificates and revocation information with post-quantum algorithms. That puts machine identities, the certificates, keys and tokens that workloads use to prove who they are, in the critical path.
- Machine certificates: every mTLS client certificate, service mesh identity and device certificate signed with RSA or ECDSA is on the 2035 list. Certificate authorities, their HSMs and the relying parties that validate chains all need ML-DSA support before issuance can switch. See the Machine Identity, PKI and Certificate Lifecycle Guide.
- Long-lived roots of trust: root CA keys, firmware signing keys and HSM-held keys often outlive the equipment they were bought with. A root issued today with a 20-year validity crosses both 2030 and 2035.
- Code signing: signatures on software and firmware must verify for the life of the product, which is why the stateful hash-based schemes in SP 800-208 are relevant. See the Code Signing Security Guide.
- Tokens and federation: JWTs, SAML assertions and OAuth client assertions signed with RS256 or ES256 are quantum-vulnerable signatures in the same sense, though their short lifetime means the risk is forgery after 2035 rather than harvested secrets.
- PIV and smart cards: the draft lists FIPS 201-3 among the application standards to update, so hardware credential refresh cycles need to be planned against the dates.
Our identity-specific migration view is in the Post-Quantum Migration for NHIs Guide.
Implementation steps
- Record the document status. Log IR 8547 as a draft dated November 2024, with the date you last checked, and assign an owner to watch CSRC for a revision or final version and for SP 800-131A Rev. 3.
- Build a cryptographic inventory. List every use of RSA, ECDSA, EdDSA, DH and ECDH with algorithm, key size, security strength, protocol, owner and data lifetime. Certificate stores, HSMs, KMS keys, TLS and IKE configurations, SSH host keys and code signing keys come first. See the Cryptographic Inventory and CBOM Guide.
- Tag each item with its IR 8547 date. 112-bit items get 2030 (deprecated) and 2035 (disallowed); 128-bit and above get 2035. Add the data confidentiality lifetime: if data captured today must stay secret beyond 2035, the item is already urgent.
- Prioritise key establishment in transit. TLS, IKEv2 and other interactive protocols protecting long-lived secrets go first, in line with the draft. Pilot hybrid ML-KEM groups in a test ring before production.
- Write the dates into procurement. Require FIPS 203 and FIPS 204 support (or a dated roadmap), crypto-agility through configuration rather than firmware replacement, and FIPS 140-3 validation status for modules. The CISA, NSA and NIST quantum-readiness factsheet makes the same point about engaging vendors early.
- Plan PKI and signing changes. Decide on hybrid, composite or parallel certificate hierarchies, test relying party support, and schedule root and intermediate replacements so no new key is issued with a validity crossing 2035 on a quantum-vulnerable algorithm without a documented exception.
- Retire weak symmetric and hash uses. Remove SHA-1 signatures, ECB mode and 112-bit symmetric uses in parallel, following SP 800-131A.
- Keep a rollback path. Deploy new algorithms behind configuration flags, keep classical fallbacks during pilots, and measure handshake failures before removing them.
The Crypto-Agility Guide covers how to design systems so each of these swaps is a configuration change.
Evidence and assessment
Auditors and customers will increasingly ask how you are tracking these dates. Useful evidence includes:
| Evidence item | What it shows | Measure |
|---|---|---|
| Cryptographic inventory or CBOM | Coverage of quantum-vulnerable uses | Percentage of systems inventoried, by criticality |
| Migration plan with IR 8547 dates | Prioritisation by data lifetime and exposure | Items with an owner and target date |
| Procurement clauses | New purchases will not extend the problem | Percentage of new contracts with PQC requirements |
| Certificate issuance reports | No new long-lived quantum-vulnerable keys | Count of certificates with validity beyond 2035 on RSA or ECC |
| Protocol telemetry | Hybrid key exchange in use | Share of TLS and IKE sessions using ML-KEM hybrids |
| Exception register | Accepted risk is visible and time-bound | Open exceptions past their review date |
Review the plan at least annually and on any change to the NIST documents. Track the count of 112-bit items remaining against the 2030 line as the headline metric for executives.
Mapping to other frameworks
| Framework | Reference | Link to IR 8547 work |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SC-13 Cryptographic Protection; SC-12 Cryptographic Key Establishment and Management; SC-17 Public Key Infrastructure Certificates | Approved algorithms, key establishment and PKI changes |
| NIST SP 800-53 Rev. 5 | CM-8 System Component Inventory; SA-4 Acquisition Process | Cryptographic inventory and procurement requirements |
| NIST CSF 2.0 | ID.AM-07, PR.DS-01, PR.DS-02, GV.SC-05 | Inventory, data at rest and in transit, supplier requirements |
| CIS Controls v8.1 | Control 3 Data Protection (3.10 encrypt sensitive data in transit, 3.11 at rest) | Where algorithm choices are applied |
| ISO/IEC 27001:2022 | Annex A 8.24 Use of cryptography | Cryptography rules and key management, including algorithm lifecycle |
| UK NCSC PQC migration timelines | 2028 discovery and plan, 2031 priority migrations, 2035 full migration | Comparable national milestones for non-US organisations |
Common pitfalls
- Treating the draft as final: policies that cite "NIST IR 8547" without noting draft status will need rewriting if dates move. Cite it as the ipd and record the check date.
- Reading 2035 as the start date: anything encrypted today with ECDH or RSA key transport and needing secrecy past 2035 is already exposed to harvest now, decrypt later.
- Ignoring the 2030 marker: large estates of RSA-2048 keys in internal PKI, VPN gateways and legacy appliances hit deprecation first.
- Buying fixed-function hardware: HSMs, smart cards and network appliances bought now without a PQC firmware path will be in service past 2035.
- Replacing AES-256 unnecessarily: effort spent on symmetric changes the draft does not ask for is effort not spent on public key migration.
- Forgetting machine identities: inventories that stop at web servers miss service-to-service certificates, SSH keys and token signing keys, which far outnumber human-facing ones.
Practitioner checklist
- Record IR 8547 as an Initial Public Draft (12 November 2024) and set a quarterly check of the CSRC page.
- Complete a cryptographic inventory that captures algorithm, key size and security strength for every public key use.
- Tag every 112-bit item for 2030 deprecation and every quantum-vulnerable item for 2035 disallowance.
- Rank items by data confidentiality lifetime and move long-lived key establishment (TLS, IKEv2) first.
- Add FIPS 203, FIPS 204 and crypto-agility requirements to every new technology contract.
- Stop issuing quantum-vulnerable keys or certificates with validity beyond 2035 without a recorded exception.
- Include machine identities, code signing keys and token signing keys in scope.
- Remove SHA-1, ECB and 112-bit symmetric uses in parallel under SP 800-131A.
- Report progress against the 2030 and 2035 lines to leadership at least annually.
Standards and references
- NIST: IR 8547 (Initial Public Draft) Transition to Post-Quantum Cryptography Standards
- NIST: IR 8547 ipd full text (PDF)
- NIST: FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard
- NIST: SP 800-227 Recommendations for Key-Encapsulation Mechanisms
- NIST: SP 800-131A Rev. 3 (Initial Public Draft) Transitioning the Use of Cryptographic Algorithms and Key Lengths
- NCSC: Timelines for migration to post-quantum cryptography
- CISA, NSA and NIST: Quantum-Readiness: Migration to Post-Quantum Cryptography
Related NHI Mgmt Group resources: Q-Day Planning Guide · Post-Quantum Cryptography Migration Guide · Cryptographic Inventory and CBOM Guide · Post-Quantum Migration for NHIs Guide