NIST IR 8547 sets the timetable for post-quantum migration. Here is where to start

NIST published NIST IR 8547, Transition to Post-Quantum Cryptography Standards. It sets out how the move away from quantum-vulnerable public-key cryptography is expected to proceed, and the dates that will shape it. For security leaders, the main point is about time. The deadlines have been set, the migration will take several years, and the first task is to establish where your cryptography is used today.

What the report covers

NIST published three post-quantum standards in 2024: ML-KEM for key establishment (FIPS 203), ML-DSA for digital signatures (FIPS 204), and SLH-DSA, a hash-based signature scheme (FIPS 205). The new report describes how the wider ecosystem should move onto them and what happens to the older algorithms. NIST recommends ML-KEM-768 as the default parameter set. It is also working on HQC as an alternative key-establishment scheme and on a further signature standard.

The report is written for federal agencies, technology providers, standards bodies and the laboratories that validate cryptographic modules. Its timelines matter to any organisation that relies on RSA, elliptic curve or Diffie-Hellman key exchange.

The dates that matter

  • Federal high-value and high-impact systems must adopt post-quantum key establishment by 31 December 2030, and post-quantum digital signatures by 31 December 2031, under Executive Order 14412 and OMB Memorandum M-26-15.
  • The federal target for completing the wider migration is 2035.
  • NIST’s own standards will deprecate quantum-vulnerable public-key algorithms after 2030 and disallow them after 2035.
  • Older symmetric options are also being retired. 112-bit symmetric algorithms will be disallowed in 2030, and SHA-1 will leave FIPS-validated modules after 2030.
  • TLS 1.3 must be supported by federal agencies no later than 2 January 2030.

These federal deadlines do not bind private companies directly. They will still shape procurement, product roadmaps and the vendors you buy from.

Why key establishment comes first

Adversaries can collect encrypted data today and decrypt it once a cryptanalytically relevant quantum computer exists. This is the harvest now, decrypt later threat. Data that must stay confidential for years is already exposed in this way, which is why key establishment carries an earlier deadline than signatures.

Signatures are not exposed to this attack, but they are slow to replace. They sit inside certificates, PKI, firmware and code signing, and devices may keep verifying them for years. The report also draws on Mosca’s theorem. If the years your data must stay confidential, added to the years your migration will take, exceed the years until a relevant quantum computer arrives, you must start now.

Hybrid is a bridge, not a destination

The report describes hybrid approaches that combine a classical algorithm with a post-quantum one. A hybrid hedges against a flaw in either component, and it can accommodate sector requirements that still call for legacy algorithms. The report is equally clear on the costs. Hybrids add complexity, can increase security risk and cost, and are typically intended as temporary measures that lead to a later move to post-quantum algorithms alone.

NIST will accommodate hybrid key establishment and dual signatures in FIPS 140 validation when they are combined with an approved scheme. If you deploy a hybrid, plan its exit from the start.

Validation and hardware will set the pace

Executive Order 14412 directs NIST to revise its cryptographic module validation processes to accelerate the validation of post-quantum modules. Validation is only one bottleneck. The report notes that hardware has long research, design and fabrication lead times, so vendors should begin post-quantum support immediately. Deployed credentials, such as PIV cards, follow multi-year issuance and replacement cycles, so they also need early work.

Where to start

  1. Build a cryptographic inventory. The report begins migration with inventories. Record where RSA, elliptic curve and Diffie-Hellman are used, including TLS endpoints, VPNs, certificates, code-signing pipelines, libraries, hardware security modules and third-party services.
  2. Rank by data lifetime. Systems that protect long-lived confidential data go first, in line with the harvest now, decrypt later risk.
  3. Put TLS and key exchange at the front of the queue. NIST plans to reflect hybrid ML-KEM guidance for TLS in the next revision of SP 800-52.
  4. Design for agility. Systems should be able to replace algorithms without rewriting applications.
  5. Ask your vendors the hard questions. Which post-quantum algorithms are supported, what is validated, what is the hybrid plan, and when does the hardware roadmap arrive?

The standards are published, the deadlines are set, and the work ahead is measured in years. The organisations that move early will be those that know what they run today. A cryptographic inventory is the place to start, and it is what makes every later decision, from ranking systems to choosing hybrids, possible.

NIST has said it will keep monitoring developments and adjust its transition efforts as new technical or operational information emerges. Organisations should plan in the same way: build cryptographic agility into their infrastructure now, so that they can accept updated standards without another large programme of work.