Read this first
NIST's IR 8547, Transition to Post-Quantum Cryptography Standards, sets out the timeline for retiring quantum-vulnerable public-key cryptography. The algorithms in near-universal use today, RSA, finite-field and elliptic-curve Diffie-Hellman, ECDSA, and EdDSA, are slated to be deprecated after 2030 and disallowed after 2035. The replacements are the finalized standards: ML-KEM (FIPS 203) for key establishment, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures, alongside the stateful hash-based schemes LMS and XMSS. The point of the dates is to make the migration a schedule, not a someday.
Most post-quantum urgency is argued from the threat: a large enough quantum computer, someday, breaks RSA and elliptic curves. That is true, and the date is unknown, which makes it easy to defer. The more useful pressure is not the threat date. It is the compliance date, and NIST has now written it down. IR 8547 turns an open-ended risk into a calendar.
What the deadlines actually say
The report draws a line at two years. After 2030, the classical public-key algorithms are deprecated, meaning their use is discouraged and carries risk that has to be accepted deliberately. After 2035, they are disallowed, meaning they should not be used at all in the systems the guidance covers. That applies to the primitives that carry essentially all of today's public-key security: RSA, Diffie-Hellman in both its finite-field and elliptic-curve forms, ECDSA, and EdDSA. The named successors are the algorithms NIST finalized in 2024: ML-KEM for key exchange, ML-DSA and SLH-DSA for signatures, with LMS and XMSS for the narrower stateful-signature cases.
It is worth being precise that IR 8547 is guidance describing NIST's expected approach, not a self-executing law, and the current document is a public draft. But it is the reference every downstream mandate, procurement rule, and auditor will point at, which makes the 2030 and 2035 dates the planning horizon in practice whether or not they bind you directly.
Why a 2035 deadline is a today problem
Ten years sounds like room to wait. It is not, for two reasons. The first is harvest-now-decrypt-later: data with a confidentiality lifetime that runs past the moment a quantum computer arrives is effectively exposed the day it is captured, not the day it is decrypted, so anything you need secret into the 2030s is already on the clock. The second is that migrations of this size are measured in years, not sprints. You have to discover every place the doomed algorithms live, across code, dependencies, protocols, certificates, and hardware, prioritize by risk, replace, and validate, often in systems you cannot take offline. Working backwards from disallow-after-2035, with multi-year programs and long-lived data, the honest start date is now.
The point
The point
The value of IR 8547 is not that it reveals a new threat. It is that it converts an unknowable threat date into a fixed pair of compliance dates, deprecate after 2030, disallow after 2035, that you can actually plan against. A deadline you can schedule beats a risk you can defer.
So treat the dates as a backward-planning anchor, not a countdown to watch. The first move is not to buy an algorithm; it is to find out where RSA, ECDSA, and Diffie-Hellman actually run in your systems, because you cannot retire what you have not enumerated. That inventory is a cryptographic bill of materials, and it is the step every framework, NIST's included, puts first.
References
- NIST IR 8547, Transition to Post-Quantum Cryptography Standards (csrc.nist.gov) - the deprecate-2030 / disallow-2035 timeline and the algorithms in scope.
- NIST FIPS 203 / 204 / 205 (csrc.nist.gov) - the finalized ML-KEM, ML-DSA, and SLH-DSA standards that replace them.
- quantakrypto: build a CBOM with qScan - enumerating the algorithms the deadlines retire.