What is post-quantum cryptography? NIST set 2030 to retire RSA and elliptic curves on October 27
Post-quantum cryptography (PQC) is a family of public-key algorithms built to resist attacks by large quantum computers, which could break today's RSA and elliptic-curve cryptography using Shor's algorithm. On October 27, 2026, NIST finalized IR 8547: RSA, ECDSA, EdDSA, Diffie-Hellman and other quantum-vulnerable public-key algorithms are deprecated after 2030 and disallowed after 2035, at every approved strength. The 2024 draft had targeted only 112-bit parameters such as RSA-2048 for 2030. The replacements are ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures, with HQC selected as a backup key-exchange method.
The three lines
- Meaning — public-key encryption designed to survive quantum computers, replacing RSA and ECC
- Deadline — NIST final IR 8547 (Oct 27): deprecated after 2030, disallowed after 2035
- Replacements — ML-KEM for key exchange, ML-DSA and SLH-DSA for signatures, HQC as backup
Key questions
- what is post quantum cryptography
- **New public-key encryption based on math problems believed hard even for quantum computers. It runs on ordinary computers.** | | Today's public-key crypto | Post-quantum crypto | |---|---|---| | Hard problem | Factoring (RSA), discrete log (elliptic curves) | Lattices, hashes, codes | | Quantum attack | Broken by Shor's algorithm | No known efficient attack | | Runs on | Ordinary computers | Ordinary computers | | Standards | Decades old | First FIPS in August 2024 |
- nist rsa deprecation 2030 2035
- **Under the final NIST IR 8547, RSA at any approved size is deprecated after 2030 and disallowed after 2035.** | Stage | When | Meaning | |---|---|---| | Deprecated | After 2030 (from Jan 1, 2031) | Still usable, but the data owner must assess the risk | | Disallowed | After 2035 | No longer approved for that purpose | | Covered | RSA and ECDSA signatures (112-bit+), EdDSA (128-bit+), DH, MQV and RSA key establishment | — |
- ml-kem vs ml-dsa
- **ML-KEM securely establishes shared keys; ML-DSA creates digital signatures. Both are lattice-based.** | Standard | Name | Use | Basis | Status | |---|---|---|---|---| | FIPS 203 | ML-KEM | Key encapsulation | Lattice | Final, Aug 2024 | | FIPS 204 | ML-DSA | Signatures | Lattice | Final, Aug 2024 | | FIPS 205 | SLH-DSA | Signatures | Hash | Final, Aug 2024 | | FIPS 206 (planned) | FN-DSA | Compact signatures | Lattice | In development | | In development | HQC | Backup key exchange | Codes | Selected Mar 2025 |
Today's internet locks rely on one fact: large numbers are hard to break apart. Quantum computers are machines that could undo that fact. Post-quantum cryptography (PQC) is new public-key encryption designed to survive them. On October 27, 2026, NIST fixed the migration timetable: RSA and elliptic-curve cryptography, at any approved key size, are deprecated after 2030 and disallowed after 2035.
1. Why it is needed — quantum computers and 'harvest now, decrypt later'
Every HTTPS connection, encrypted message and software update uses public-key cryptography, mainly RSA and elliptic-curve cryptography (ECC). In 1994 mathematician Peter Shor showed that a sufficiently large quantum computer could solve both underlying problems quickly. No such machine exists yet, but there are reasons to move now.
| Threat | What it is | Why act today |
|---|---|---|
| Harvest now, decrypt later (HNDL) | Adversaries store encrypted traffic now and decrypt it once quantum machines exist | Anything that must stay secret for ten years is already exposed |
| Signature forgery | Private keys recovered to forge signatures | Long-lived certificates and firmware signatures take years to replace |
| Migration time | Hardware, software and protocols must all change | Retiring SHA-1 took more than a decade |
2. What replaces it — NIST's five picks
| Standard | Name (former candidate) | Use | Math | Status |
|---|---|---|---|---|
| FIPS 203 | ML-KEM (CRYSTALS-Kyber) | Key exchange | Lattice | Final Aug 2024; ML-KEM-768 recommended default |
| FIPS 204 | ML-DSA (CRYSTALS-Dilithium) | Signatures | Lattice | Final Aug 2024 |
| FIPS 205 | SLH-DSA (SPHINCS+) | Signatures | Hash | Final Aug 2024 |
| FIPS 206 (planned) | FN-DSA (Falcon) | Compact signatures | Lattice | In development |
| In development | HQC | Backup key exchange | Codes | Selected Mar 2025 |
Lattice-based schemes are the workhorses; HQC is insurance in case lattices turn out weaker than believed. During the transition, "hybrid" key exchange combines classical ECC with ML-KEM so that the connection stays safe if either holds. The final report says such hybrids can be FIPS 140-validated if one component is an approved scheme like ML-KEM.
3. The timetable — what changed in the final version
| Item | November 2024 draft | October 27, 2026 final |
|---|---|---|
| Deprecated after 2030 | Only 112-bit parameters (RSA-2048, P-224) | All approved quantum-vulnerable public-key algorithms (RSA, ECDSA, EdDSA, DH, MQV) |
| RSA-3072, P-256, Ed25519 | Acceptable until 2035 | Deprecated after 2030 |
| After 2035 | Disallowed | Disallowed |
| Backup KEM | 'One or more' to come | HQC; no further selections planned |
| Hybrids | Not addressed | Validatable if one approved component |
The big change is the second row: longer classical keys no longer buy extra years, because against quantum computers they do not fundamentally help. US federal systems move faster still: Executive Order 14412 (June 22, 2026) and OMB memo M-26-15 require PQC key establishment for high-value systems by the end of 2030 and signatures by the end of 2031, with a contractor rule in the works — relevant to any company selling to the US government.
4. What to do now
| Step | Action |
|---|---|
| 1. Inventory | Find every use of RSA and ECC — certificates, VPNs, firmware signing, HSMs |
| 2. Long-lived data first | Apply hybrid key exchange to traffic that must stay secret for a decade |
| 3. Crypto agility | Design systems so algorithms can be swapped easily |
| 4. Remove legacy keys | Start with already-retired keys such as 1024-bit RSA |
The last step is not theoretical: on November 6, Google DeepMind said AI agents had found two weaknesses in 1024-bit RSA. Keys of 2048 bits are unaffected, but old keys are where attacks start. With the standards body having set dates, the question has shifted from "will quantum computers arrive?" to "did we migrate before they did?"
Sources
- Cloud Security Alliance — NIST IR 8547 Final: Post-Quantum Deadlines Become Vendor Requirements (2026-10-30)
- PostQuantum — NIST IR 8547 Final (2026-10)
- Quantum Computing Report — NIST Releases Final IR 8547 Establishing Definitive PQC Transition Timeline
- Sectigo — Root Causes 447: NIST Deprecates RSA 2048 and ECC 256 (on the draft)
- Crypto Briefing — Google DeepMind's AI agents expose two weaknesses in legacy 1024-bit RSA (2026-11-06)