NIST publishes road map for the move to post-quantum cryptography
The finalized report NISTIR 8547 sets out which current encryption algorithms are vulnerable to future quantum computers, what replaces them and the timelines federal agencies must follow.
AI illustrationThe National Institute of Standards and Technology (NIST) has released a finalized report that lays out how organizations should move from today's encryption to its post-quantum cryptography (PQC) standards. The document, Transition to Post-Quantum Cryptography Standards (NISTIR 8547), names the existing cryptographic standards that a future quantum computer could break and the quantum-resistant standards designed to replace them.
NIST published its PQC standards in August 2024. The new report is its high-level road map for switching to them. It sets out NIST's official approach and timelines for leaving quantum-vulnerable algorithms behind, and it is meant to tell federal agencies, industry partners and standards organizations what needs to change and when. NIST said the details of the migration will vary by organization, while the timelines apply broadly.
Two government directives frame those timelines. National Security Memorandum 10 set 2035 as the primary target for completing the migration across federal systems. Executive Order 14412 brought the deadline forward for federal high-value assets and high-impact systems, which must migrate by 2030 for key establishment and by 2031 for digital signatures. NISTIR 8547 supports these dates. The memorandum applies to federal systems, but NIST said many organizations that work with the federal government will be affected as well.
NIST mathematician Dustin Moody, who heads the PQC standardization project, said the report describes different use cases and explains why one migration might take longer than another, since no single strategy fits every case. According to Moody, the report shows how certain algorithms in use today will be phased out, for example whether one might be disallowed in federal systems after a certain date or allowed at the user's own risk.
NIST said quantum computers are still in development, but a sufficiently powerful device, known as a cryptanalytically relevant quantum computer, would threaten the encryption that protects confidential electronic information. Encrypted data is already exposed to a harvest now, decrypt later threat, in which adversaries collect sensitive data today and plan to decrypt it once quantum technology matures. NIST gave this as one of the main reasons the transition is urgent.
Moody said some actions may take priority over others: because of that threat, organizations might first migrate to the PQC key establishment standard, FIPS 203, for data that is particularly sensitive or must stay secure for a long time. The report also covers a hybrid approach that combines conventional encryption with PQC. NIST accommodates this option, which it described as more conservative from a security standpoint but more demanding in computational resources. It added that an organization must consider its entire cryptographic supply chain, not only its own system components.
The report complements a migration-to-PQC project at NIST's National Cybersecurity Center of Excellence (NCCoE), a cross-sector collaboration working on demonstrations of cryptographic visibility, risk management practices and PQC implementations to support the migration timelines.