Threatened by quantum computers, RSA encryption will drop out of US standards after 2035

On October 27, the U.S. National Institute of Standards and Technology (NIST) published the final version of its report NIST IR 8547. The document lays out the phase-out of encryption algorithms that a future quantum computer could break. The first draft dated from November 12, 2024. Nearly two years later, the timeline is set: these algorithms will be "deprecated" after 2030, then will no longer be allowed by NIST standards and guidelines after 2035.

The list covers most of the public-key cryptography in use today. For digital signatures, it includes RSA, ECDSA and EdDSA. For key exchange, it includes Diffie-Hellman, classic or elliptic-curve, MQV and RSA. These algorithms protect HTTPS connections, VPNs, certificates and software signing. The report notes that NIST's previous guidelines planned to retire public-key algorithms with 112 bits of security on January 1, 2031. The new timeline replaces that deadline.

"Deprecated" does not yet mean "banned"

The two words have a precise meaning for NIST. A deprecated algorithm can still be used, but at a risk: it is up to the data owner to assess that risk and decide whether to keep using it. A disallowed algorithm (disallowed) can no longer be used for the purpose concerned. Between 2031 and 2035, an organization will therefore be able to keep RSA while it finishes migrating, provided it accepts the risk.

NIST embraces this flexibility. "We know there is no one-size-fits-all strategy for every use case," says Dustin Moody, the mathematician who leads the post-quantum standardization project, in the institute's announcement.

For Washington's sensitive systems, the deadline falls as early as 2030

The 2030-2035 period targets low-exposure systems and applications constrained by legacy requirements. The report stresses that it does not push back the tighter dates imposed on the federal government by Executive Order 14412 and by memorandum M-26-15 from the White House Office of Management and Budget. The most sensitive federal systems must use post-quantum cryptography for key exchange by December 31, 2030, and for signatures by December 31, 2031. Agencies must also accept TLS 1.3 by January 2, 2030 at the latest. These agencies were also due to submit their migration plan on October 22.

NIST also warns that its use-case-specific guides may require post-quantum key exchange earlier, first in TLS and in IKE, the key exchange protocol of IPsec VPNs. The reason: an attacker can record encrypted traffic today and decrypt it later, once a quantum machine is available. The report recalls that algorithm transitions have so far taken 10 to 20 years. It calls for making this an operational priority right now.

What these dates change for a European company

Legally, nothing: NIST does not set the rules in France. But hardware security modules (HSMs), libraries and encryption services sold to the U.S. government must be validated under the FIPS 140 standard, and their roadmaps will follow this document. The dates also line up with the European roadmap, adopted by Germany: 2030 for high-risk systems, then 2035.

The report offers several useful benchmarks:

• ML-KEM-768 is the recommended default setting for post-quantum key exchange (FIPS 203 standard). HQC, selected as a backup, will be approved once its standard is published.
• Hybrid modes, which combine a classical algorithm with a post-quantum one, can obtain FIPS 140 validation if they include an approved algorithm. NIST leaves it to each application to judge whether the extra cost is worth it. The position of ANSSI (France's national cybersecurity agency), which is stricter on this point, is detailed in our dedicated article.
• Symmetric cryptography (AES-128, SHA-256 and above) should not need to be replaced, according to NIST. However, the few symmetric standards with 112 bits of security will no longer be allowed in 2030, and SHA-1 will leave FIPS-validated modules after 2030.

The first step NIST advises is an inventory of all your uses of cryptography. A migration plan and the first deployments of compatible products come next.

What follows has already been announced. NIST is to revise its SP 800-131A guide to spell out the timelines, as well as its TLS guide (SP 800-52), which will include hybrid key exchange. Two new standards are in preparation: the HQC backup algorithm and a signature derived from FALCON. It is the use-case-specific guides, such as SP 800-52 for TLS, that could still bring the deadlines forward.