RSA and ECC now have NIST end dates: deprecated after 4 more years, disallowed after 9

01The final plan: deprecated after 2030, disallowed after 2035

NIST published the final version of IR 8547, Transition to Post-Quantum Cryptography Standards, on 27 October 2026. Its central sentence reads: “NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035.”¹² In NIST’s terms, deprecated means the algorithm “may be used, but there is some security risk”, and the data owner decides whether to accept it. Disallowed means it is “no longer allowed for the stated purpose”.¹

The final is stricter than the draft of 12 November 2024. The draft deprecated only algorithms at 112 bits of classical security strength and left stronger keys acceptable until 2035.³ The final’s tables apply “Deprecated after 2030” to every quantum-vulnerable signature and key-establishment family at 112 bits or more, so a larger RSA or elliptic-curve key no longer extends the schedule.¹

For the most sensitive federal systems the 2030 window does not apply. Executive Order 14412 of 22 June 2026 requires high-value assets and high-impact systems to move key establishment to post-quantum algorithms by 31 December 2030 and signatures by 31 December 2031.⁴ OMB’s memorandum M-26-15 of 24 June adds TLS 1.3 support by 2 January 2030 and tells agencies to align their plans with IR 8547.⁵ The order also gave the FAR Council 180 days to propose a rule requiring covered contractors to comply with FIPS, “including all applicable FIPS incorporating PQC compliant algorithms”, by 31 December 2030.⁴ National security systems are excluded from the order and follow NSA: from 1 January 2027 new acquisitions must meet CNSA 2.0 “unless otherwise noted”.⁷

02What goes, and what replaces it: one key-exchange standard, three signature options

IR 8547 lists six quantum-vulnerable families across signatures and key establishment, all on the same schedule. For key establishment, “ML-KEM is the only approved post-quantum key-establishment scheme based on public-key cryptography”, and NIST recommends ML-KEM-768 as the default parameter set. HQC has been selected as an alternative; its FIPS is still being written.¹ FIPS 203, 204 and 205 were published on 13 August 2024.⁶¹⁷

Two details matter for products. Hybrid key exchange, which runs a classical and a post-quantum algorithm together, can still be FIPS 140-validated “as long as at least one of the inputs” comes from an approved scheme. And symmetric algorithms at the 112-bit level will be disallowed in 2030, with SHA-1 disallowed in FIPS-validated modules after 2030.¹ NSA asks more of national security systems: ML-KEM-1024 and ML-DSA-87 at every classification level, and it “will not require” hybrid products.⁷

03Outside the US federal market, the roadmaps converge on 2035

The UK’s National Cyber Security Centre published three milestones on 20 March 2025: discovery and an initial plan by 2028, the highest-priority migrations by 2031, and migration of “all your systems, services and products” by 2035.⁸ The EU’s coordinated roadmap, published on 23 June 2025, asks member states to start national transitions by 31 December 2026, finish high-risk use cases by 31 December 2030 and medium-risk ones by 31 December 2035.⁹ India’s task-force roadmap is the fastest of these, and it is a recommendation, not a mandate.¹⁵

04Browsers have mostly switched; the servers behind them have not

On the public web the client side moved before the rules did. Google said on 13 September 2024 that Chrome 131 would switch its hybrid post-quantum key exchange from the pre-standard Kyber to ML-KEM.¹³ Apple says TLS connections in iOS 26, iPadOS 26, macOS Tahoe 26 and visionOS 26 “will automatically advertise support” for hybrid key exchange.¹⁴ Cloudflare measured about two per cent of its TLS 1.3 connections as post-quantum in March 2024, over 65% of human traffic in April 2026, and over two-thirds of browser traffic in June 2026.¹²¹¹¹⁸

The gap is the part a buyer controls. Cloudflare reports roughly 70% of browser-generated traffic reaching it protected with hybrid ML-KEM, but “just about 15% of origins that Cloudflare connects to use hybrid ML-KEM”. It names X25519MLKEM768 as “the only recommended algorithm for post-quantum encryption” in TLS 1.3.¹⁰ Each of those origins is a web server, load balancer or appliance someone bought. Authentication is a separate problem: Cloudflare’s own target for post-quantum security, “including, crucially, post-quantum authentication”, is 2029.¹¹

05What to ask a vendor now: six questions

IR 8547 tells organisations to begin “with cryptographic inventories, migration planning, and early deployments of PQC-enabled products and services”, and says hardware vendors should start integrating post-quantum support “immediately” because of long design and fabrication lead times.¹ For a buyer that becomes a set of questions to put in writing at the next purchase or renewal. They are questions, not a test any named product passes or fails.

The last question has an Indian source. CERT-In’s bill-of-materials guidelines suggest “tiered vendor Post-Quantum Cryptography (PQC) contractual requirements”, with quarterly migration progress reports carrying executive attestation and a quantum-safe proof of concept before contract renewal.¹⁶ For cloud services, OMB tells US agencies to agree post-quantum responsibilities with providers “within the shared responsibility model”, a useful clause for any buyer.⁵ Our encryption and rights management guide lists the key-management and HSM products to put these questions to.