NIST Sets 2030 and 2035 Post-Quantum Cryptography Deadlines
NIST has established a timeline for replacing the public-key cryptography currently securing most digital systems. In October 2026, the agency released NISTIR 8547, Transition to Post-Quantum Cryptography Standards. This roadmap specifies which algorithms will be phased out and when. Though primarily targeting federal systems, these deadlines also impact contractors, cloud providers, and device manufacturers supplying those systems.
This guide will explain NIST’s standardized algorithms, the new binding deadlines, why suppliers are now being evaluated for quantum readiness, and the steps security and engineering teams can take before the deprecation of RSA, ECDSA, and ECDH in 2030. It’s important to note upfront that NIST does not predict when a cryptanalytically relevant quantum computer will exist; therefore, all timelines here are driven by policy and data lifespans, not a known arrival date.
NIST’s Standardized Algorithms
In August 2024, NIST finalized three post-quantum standards. ML-KEM, published as FIPS 203, enables two parties to establish a shared secret over a public channel. ML-DSA and SLH-DSA, published as FIPS 204 and FIPS 205, generate digital signatures to verify data origin and integrity during transit.
These algorithms operate on standard computers. Organizations can integrate them into existing systems through software and firmware updates, without requiring new hardware. NIST’s final report recommends ML-KEM-768 as the default parameter set for key establishment, citing its security margin against reasonable performance costs, though the agency allows alternatives when necessary.
Security researchers classify these schemes as “believed secure” rather than “proven unbreakable.” They resist all known attacks, including those from a future quantum computer, but no one has proven that no faster attack exists. This distinction is why hybrid approaches are used, a topic we will return to.
It’s crucial to differentiate between three distinct tools: PQC replaces vulnerable cryptographic math within existing protocols. Quantum Key Distribution (QKD) uses physics to distribute keys over dedicated links. Quantum Random Number Generation (QRNG) produces entropy. Each solves different problems, and NISTIR 8547 specifically addresses PQC.
Binding Deadlines
NISTIR 8547 transforms previous guidance into firm obligations with specific dates. Key milestones include:
- After 2030: NIST deprecates public-key algorithms vulnerable to quantum attacks, such as RSA, ECDSA, and ECDH. Deprecation allows continued use during migration with acknowledged risk, as per the NIST IR 8547 action-plan analysis.
- After 2035: These same algorithms are disallowed under NIST standards and guidelines, meaning their permitted use for specified purposes ends.
- End of 2030: Federal high-value assets and high-impact systems must adopt quantum-resistant key establishment, as mandated by Executive Order 14412.
- End of 2031: The same prioritized systems must adopt quantum-resistant digital signatures.
- 2035: The overall federal migration target, initially set by National Security Memorandum 10.
- January 2, 2030: Federal agencies must support TLS 1.3, as per directives mentioned in the report. Supporting a protocol version alone does not guarantee post-quantum protection; that is determined by the algorithms a connection negotiates.
NIST also points out that past cryptographic transitions have taken 10 to 20 years from standardization to full integration, making the compressed federal schedule particularly challenging.
Why Vendors Are Now Scored on Quantum Agility
Most organizations don’t develop their own cryptography; it comes embedded in the software libraries, hardware security modules, and certificate systems they purchase. As NISTIR 8547 explains, an application can simultaneously rely on a crypto library, an HSM, and a public key infrastructure, each potentially requiring changes before the application can utilize PQC. A supplier might release a PQC update before a customer’s infrastructure is ready, or a customer might complete its own work as they await a hardware vendor.
This makes procurement a critical enforcement point. For a buyer, the question isn’t merely whether a single product advertises PQC support. It’s whether every component supporting a business service can migrate in unison, and whether a vendor’s timeline relies on existing and tested products.
The “harvest now, decrypt later” threat adds urgency. An adversary can collect encrypted traffic today and hold it until decryption becomes feasible. A later upgrade can’t protect data already captured. NIST frames the planning using Mosca’s theorem: add the required secrecy duration of data to the time needed for migration. If this sum extends beyond the potential arrival of a quantum computer, you are already behind schedule.
Third-party scoring is emerging as its own product category. On October 21, 2026, Black Kite integrated Quantum Readiness checks into its third-party cyber risk platform, assessing vendor exposure to quantum attacks. This announcement from the vendor, noted here once, signals a trend: buyers are increasingly demanding verifiable evidence of supplier readiness, rather than accepting marketing claims at face value.
Case Study: Zcash’s Layered Migration
Zcash illustrates how migration happens in stages rather than a single upgrade. On October 18, 2026, Zcash developers proposed a dedicated incoming viewing key for every ZEC swap through NEAR Intents, with recovery managed via private information retrieval. The proposal was under review, requiring no consensus upgrade for adoption.
Separately, Zcash developers set a January target for quantum-resistant payments, with hash-based signatures for transparent transactions identified as a near-term development goal. Hardware-wallet firmware lags behind protocol work, mirroring the dependency enterprise buyers face with their own devices.
The lesson for supply-chain teams is that partial mitigations ship first, and already published data remains exposed. A new viewing-key scheme protects future swaps but does nothing for transactions already on a public ledger. The same applies to any system where confidential records have already traversed a network an adversary could have recorded.
A Five-Step Supplier Readiness Checklist
- Build a cryptographic inventory. Map algorithms to the services they support, the data they protect, and the supplier responsible for modifying each. Value comes from these connections, not just a raw count of assets.
- Incorporate PQC into contracts. Require FIPS 203/204/205-based roadmaps from suppliers, and request hybrid post-quantum key exchange where appropriate. Confirm what a connection does when preferred algorithms are unavailable, as offering a choice between conventional and PQC is not the same as providing combined protection.
- Prioritize long-shelf-life data. Records requiring confidentiality for a decade or more should be addressed first, as they have the highest “harvest-now-decrypt-later” exposure.
- Map your deadline exposure. Track which systems are subject to the end-of-2030 and end-of-2031 federal rules through contracts, and treat the post-2030 deprecation of RSA, ECDSA, and ECDH as the practical planning horizon.
- Establish a review cadence through 2035. Revisit supplier progress on a fixed schedule, and view hybrid deployments as temporary, as NIST anticipates a later transition to PQC-only tools.
What’s Next
The deadlines are set. Organizations that inventory their cryptography now and demand FIPS-based roadmaps from suppliers can complete their transitions before the 2030 deprecation, avoiding a scramble. For details on standard selection and migration steps, refer to QNews coverage of the NIST road map. For more reporting on PQC standards, deadlines, and vendor readiness, continue following QNews.