NIST sets out US post-quantum migration roadmap

The US National Institute of Standards and Technology has published a final roadmap for replacing cryptography vulnerable to future quantum computers, setting out how federal agencies and their suppliers should prepare for the change. Released on 27 October, NIST IR 8547 supports existing deadlines that bring the government's most sensitive systems into the transition earlier than its wider 2035 target.

The report moves beyond choosing new algorithms to the harder question of deploying them across working systems. It covers the software, hardware and certificate infrastructure that must change, and explains why organisations handling information with a long confidential life cannot wait for a powerful quantum computer to appear.

NIST is not reporting that such a computer has already broken today's protections. Its concern is that encrypted information can be collected now and deciphered later, once the necessary technology exists. The report says earlier cryptographic transitions have taken 10 to 20 years, leaving agencies and suppliers limited time to prepare.

Earlier deadlines for sensitive federal systems

According to the final report, Executive Order 14412 and Office of Management and Budget memorandum M-26-15 already require federal high-value assets and high-impact systems to adopt post-quantum cryptography for key establishment by 31 December 2030. Their digital signatures must make the transition by 31 December 2031. The October publication supplies a technical framework for those requirements, rather than announcing the deadlines for the first time.

Key establishment enables authorised parties to obtain the keys used to protect information. Digital signatures help establish who created or approved material and whether it has been altered. These functions have different migration pressures: captured encrypted data creates a long-term confidentiality problem, while changing signature systems can require coordination across many organisations and devices.

Agencies must give similar priority to other systems with highly sensitive information or particular exposure to quantum attacks. That includes data expected to remain mission-sensitive in 2030. The report also records an existing requirement for agencies to support version 1.3 of Transport Layer Security, a protocol used to protect network communications, by 2 January 2030.

The broader transition still runs towards 2035. NIST plans to deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under its standards and guidelines after 2035. The intervening period accommodates lower-risk applications and older systems with migration constraints. It does not extend the earlier deadlines for priority federal systems.

Deprecation is not the same as an immediate prohibition. The report says a deprecated algorithm can still be used with recognised security risk that the data owner must assess. Disallowed means it is no longer permitted for the specified purpose. Separate provisions can allow older algorithms to process information already protected, such as checking an existing signature.

A change across the technology supply chain

NIST's immediate starting points are inventories of existing cryptography, migration plans and early deployment of products supporting the new standards. Organisations must account for dependencies beyond an individual application. A service may need changes to its software libraries, security hardware and certificate infrastructure before its own migration is possible.

The report builds on standards published in 2024. FIPS 203 specifies ML-KEM for establishing shared secret keys; FIPS 204 and FIPS 205 specify post-quantum digital-signature methods. NIST distinguishes these replacements from symmetric cryptography, including established approaches such as AES, which it considers less vulnerable to known quantum attacks. The transition therefore does not mean replacing every cryptographic mechanism indiscriminately.

Hardware presents a particular planning problem. Security modules may need new firmware or redesigns to handle different key sizes and computational demands. NIST urges vendors to begin integrating support because design and manufacturing take time. Some long-lived devices cannot update the code that checks software signatures after manufacture, making their initial design especially important.

Hybrid systems bring trade-offs

The report accommodates hybrid approaches combining established and post-quantum methods. Such designs can provide protection if one component develops a weakness, but they also add engineering complexity, processing demands and cost. NIST leaves the choice to individual applications rather than treating hybrid deployment as a universal requirement.

For suppliers serving US federal customers, the practical issue is whether their products and supporting infrastructure can meet the customer's migration timetable. The roadmap also addresses other organisations and critical-infrastructure operators planning similar changes. Its federal requirements should not be presented as an Indian legal deadline. NIST says further standards work will provide more detailed schedules and application-specific guidance as the transition proceeds.

Source attribution: Moody D, Perlner R, Regenscheid A, Robinson A, Cooper D (2026), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, National Institute of Standards and Technology, report DOI, accessed 27 October 2026. Republished courtesy of the National Institute of Standards and Technology. This article is an original news adaptation prepared on 27 October 2026.