NIST IR 8547 Final Deprecates All RSA and ECC Keys After 2030

The countdown now has dates

On October 27, 2026, the National Institute of Standards and Technology published the final version of NIST Internal Report 8547, Transition to Post-Quantum Cryptography Standards. It is the agency's plan for retiring the public-key algorithms that a large enough quantum computer could break.2427 The headline dates did not change from the draft. Quantum-vulnerable public-key cryptography is deprecated after 2030 and disallowed under NIST standards and guidelines after 2035.2427

What changed is how much the deprecation date covers. That change is easy to miss, because much of the guidance still circulating describes the draft.

NIST released IR 8547 as an initial public draft on November 12, 2024, and closed comments on January 10, 2025.22 For almost two years the draft was the only text available. Explainers published as recently as September and October 2026 still called it unfinalized.223019 Those explainers were right at the time. As of this week, though, the 2030 date means something stricter than they describe.

What the final report actually does

Under the 2024 draft, only algorithms at the 112-bit security level faced deprecation after 2030. RSA-2048 and the P-224 elliptic curve were the usual examples.2122 Stronger options like P-256, RSA-3072 and Ed25519 had no deprecation step at all. They stayed acceptable until disallowance after 2035.24 Early readers pointed out the distinction quickly. When the draft came out, commenters noted that the 2030 date did not touch the widely used secp256r1 curve or RSA keys of 3,072 bits and up.29

The final report removes that split. NIST now deprecates these algorithms at every approved strength after 2030. That covers RSA and ECDSA signatures at 112 bits or more, EdDSA at 128 bits or more, and Diffie-Hellman, MQV and RSA key establishment at 112 bits or more.24 One analysis put the practical effect this way: any migration plan that kept P-256 or RSA-3072 on a 2035 schedule now includes a deprecated algorithm starting in 2031.24 Coverage of the final text agrees that all quantum-vulnerable signature and key-establishment schemes now follow one track, whatever the key length.27

The report includes several other changes:

• Hybrid key exchange gets a validation path. A hybrid scheme that includes a disallowed classical component can still receive FIPS 140 validation if at least one input comes from an approved scheme. NIST says it will update SP 800-56C to allow either ordering.24
• ML-KEM-768 is the recommended default parameter set.24
• HQC is confirmed as the second KEM, with a FIPS under development and no plans for more KEM selections. NIST is also developing the FALCON-based FN-DSA standard.24
• TLS is an early priority. Guidance on hybrid TLS is promised for the next revision of SP 800-52.24
• Systems that cannot migrate should be identified and prioritized for replacement or decommissioning.24
• The schedule can move. NIST says it will monitor developments and adjust its transition efforts as needed.24

"Deprecated" does not mean "broken." In NIST's terms, a deprecated algorithm is discouraged but still allowed with restrictions, while a disallowed one is no longer approved in NIST-conformant systems.23 RSA does not stop working in 2031. After 2030, data owners using it must assess the risk and decide whether to continue.27 Several analyses treat the five years between the two dates as the intended migration runway. New deployments should avoid deprecated algorithms, and existing systems have until 2035 to finish moving.2825

Why NIST tightened the screws

The main reason appears to be political. One close reading says NIST rewrote IR 8547 around the deadlines in Executive Order 14412.24 That order and its implementing memo, OMB M-26-15, were issued in June 2026. They require federal agencies to support TLS 1.3 by January 2, 2030. They also require post-quantum key establishment for high-value and high-impact systems by the end of 2030, and post-quantum signatures by the end of 2031.3027 The 2035 goal for completing the federal migration comes from National Security Memorandum 10, signed in May 2022.1627

Once the White House had committed agencies to 2030 and 2031, keeping P-256 fully acceptable until 2035 would have put NIST's guidance behind federal policy. In practice, the final report brings the standards body in line with the executive branch. NIST also says the 2030–2035 window is meant for lower-risk systems with legacy constraints and does not change the earlier federal deadlines.24 National security systems follow their own rules, including the NSA's CNSA 2.0 suite.24 CNSA 2.0 does not approve SLH-DSA, and the NSA has said it has no current plans to add FN-DSA or HQC.16

The U.S. timeline is broadly similar to timelines in other countries. The EU's coordinated roadmap calls for high-risk use cases to migrate by the end of 2030 and medium-risk ones by 2035. The UK's NCSC wants the highest-priority migrations done by 2031 and full migration by 2035. Germany's BSI recommends using classical key agreement alone only until the end of 2031.30 Private companies in the U.S. still face no direct post-quantum mandate, and sector-specific guidance from financial and health regulators remains advisory.16 Contractors are pulled in anyway, because the executive order extends its expectations through procurement.20

The hardware side: impressive progress, far from Q-Day

The policy urgency comes during a strong year for quantum hardware. Even so, the machines remain far from the scale needed to break RSA.

The industry's focus has moved from physical qubit counts to logical qubits, which are error-corrected units built from many physical ones. QuEra reported 96 logical qubits on 448 physical qubits in Nature in January 2026. One tracker calls it the largest verified count so far.69 Quantinuum's Helios, launched in November 2025, runs 98 physical qubits and 48 error-corrected logical qubits. Its next systems are Sol in 2027 and Apollo, aimed at universal fault tolerance, in 2029.3 Infleqtion said in September that it had entangled 30 logical qubits using 80 physical qubits on its Sqale platform. It is targeting 100 logical qubits in 2028 and 1,000 by 2030.7 The company also acknowledged that the result relied on error detection and software-based loss correction, not full fault tolerance.4

The large superconducting players are working on multi-year plans. IBM delivered its 120-qubit Nighthawk processor and the Loon test chip in November 2025. It expects verified quantum advantage by the end of 2026 and is aiming for Starling, with 200 logical qubits and 100 million gates, in 2029.3 Google's Willow showed below-threshold error correction in December 2024. As of September, however, Google had not declared its next milestone, a long-lived logical qubit, complete. In March 2026 it also started a neutral-atom hardware effort.3 Microsoft announced its Majorana 2 prototype in June and now expects a scalable machine by 2029. It is also building Magne, a neutral-atom system with Atom Computing in Denmark that is expected to come online in late 2026.3

Coverage of IBM's Kookaburra module disagrees. One summary describes it as a system of about 4,158 qubits.1 Another describes a qLDPC memory module targeting 7,500 gates on up to 360 qubits.6 A third reports that IBM had not announced Kookaburra's delivery as of late September.3 The more specific and recent reporting looks more credible here. Treat Kookaburra as a 2026 target, not a finished machine, until IBM's November developer event.

The distance to a cryptographically relevant machine is still very large. One widely cited estimate puts the requirement for breaking elliptic-curve keys at about 13 million physical qubits under optimistic error-correction assumptions, or around 317 million at typical current fidelities. Today's largest machines are in the low thousands.2 Other commentary argues that attack resource estimates keep falling.17 Both views can be true at once.

Why the dates matter even if Q-Day is distant

The gap between today's hardware and the hardware needed to break RSA is not a reason to wait. The risk is "harvest now, decrypt later": an adversary records encrypted traffic today and decrypts it once a capable machine exists. NIST's final report tells organizations protecting long-lived data to move early.24 The work itself is slow. Large enterprises typically need three to five years to migrate, and the inventory phase alone can take six to twelve months.13 As of early 2026, most large enterprises were still at the discovery or planning stage.14

The tools are mostly ready. FIPS 203, 204 and 205 have been final since August 2024, and HQC is expected to become a final standard around 2027.1120 With the final IR 8547, the schedule is now set as well. Any organization still running P-256 or RSA-3072 in 2031 will be using deprecated cryptography under NIST's rules, even if no quantum computer by then can break it.