The Signal
NIST Finalizes PQC Migration Guidance, Sets 2035 Cutoff
NIST’s final IR 8547 sets a transition schedule for quantum-vulnerable public-key cryptography, while federal rules require prioritized systems to move sooner. The report recommends ML-KEM-768 for key establishment and describes how applica
Quantum.world Team · Written with AI · fact-checked ·
Two clocks for the post-quantum transition
NIST’s finalized migration guidance sets 2035 as the point after which quantum-vulnerable public-key cryptography will be disallowed under NIST standards and guidelines. Federal systems identified as high value, high impact or otherwise highly sensitive face earlier targets: post-quantum key establishment by December 31, 2030, and digital signatures by December 31, 2031. The dates serve different purposes: NIST’s schedule covers standards, while federal directives set earlier goals for prioritized systems.
Published October 27, 2026, NIST Internal Report 8547, Transition to Post-Quantum Cryptography Standards, replaces an initial public draft issued in November 2024. The report describes NIST’s approach to moving from quantum-vulnerable cryptographic algorithms to post-quantum digital signatures and key-establishment schemes. It also supports Executive Order 14412 and Office of Management and Budget Memorandum M-26-15. The OMB memorandum does not apply to national security systems.
Standards set the broader timetable
IR 8547 says NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035. The schedule includes public-key digital-signature families such as RSA, ECDSA and EdDSA, and key-establishment schemes including finite-field and elliptic-curve Diffie-Hellman and MQV, as well as RSA-based schemes. Organizations may continue using these algorithms during migration, but prioritized federal systems must meet the earlier requirements.
The report identifies ML-KEM, ML-DSA and SLH-DSA, specified in FIPS 203, 204 and 205, as post-quantum standards. ML-KEM is currently the only approved post-quantum key-establishment scheme based on public-key cryptography. NIST recommends ML-KEM-768 as the default parameter set, saying it offers a large security margin at a reasonable performance cost. Other parameter sets may be used when that option is impractical or higher security is needed.
NIST selected HQC as an alternative to ML-KEM and says a FIPS specifying HQC-KEM is under development. After publication, HQC will also be an approved post-quantum key-establishment scheme. The report says NIST does not currently plan to select additional KEMs for standardization.
Applications and hybrid approaches
The transition involves more than changing algorithms. NIST says it will revise application-specific standards and guidelines, which may call for earlier transitions than the broad 2035 disallowance date. It expects to prioritize quantum-resistant key establishment in interactive protocols such as Transport Layer Security and Internet Key Exchange to address the risk of encrypted data being collected now and decrypted later.
The report also discusses hybrid approaches that combine quantum-resistant and quantum-vulnerable algorithms, or combine multiple post-quantum algorithms. NIST says these methods can serve as a hedge against flaws in component algorithms and can help where sector requirements still call for legacy methods. They can also increase implementation complexity, security risks and costs; when used, they are generally expected to be temporary.
“Historically, the journey from algorithm standardization to full integration into information systems can take 10 to 20 years.”
The report’s authors—Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson and David Cooper of NIST—write
Federal targets bring the schedule forward
Under the executive order and OMB memorandum, federal agencies must prioritize high-value assets, high-impact systems and other systems with highly sensitive data or particular exposure to quantum-computer attacks. The executive order sets December 31, 2030, for post-quantum key establishment and December 31, 2031, for digital signatures on high-value assets and high-impact systems. The OMB memorandum calls for agencies to mitigate as much quantum risk as feasible by the end of 2030 and to prioritize those sensitive systems in migration plans. It excludes national security systems.
For organizations outside those federal requirements, IR 8547 provides a standards timetable rather than a universal legal deadline. NIST says migration timelines will vary by application and risk, and that systems protecting data with long-term confidentiality needs warrant earlier attention. The report also calls for identifying systems that cannot support post-quantum cryptography so they can be prioritized for replacement or decommissioning.