TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
NIST has published NISTIR 8547, a road map for moving from quantum-vulnerable cryptography to its post-quantum standards. Federal targets call for most systems to migrate by 2035, with earlier deadlines for key establishment and digital signatures in high-value and high-impact systems.
The National Institute of Standards and Technology (NIST) has released NISTIR 8547, a road map for replacing cryptographic algorithms vulnerable to future quantum computers with post-quantum cryptography standards. The report sets out federal migration targets through 2035 and offers planning guidance for agencies and other organizations whose systems or data depend on encryption and digital signatures.
The report describes how NIST’s existing cryptographic standards will transition away from algorithms considered vulnerable to a sufficiently powerful quantum computer. It connects those phase-out plans to the post-quantum standards NIST published in 2024, and discusses how migration timelines and requirements can differ by use case. NIST presents the document as guidance for federal agencies, industry partners and standards organizations; the practical work will vary across systems and organizations.
Federal deadlines include 2035 as the broad target for completing migration, under National Security Memorandum 10. Executive Order 14412 sets earlier targets for federal high-value assets and high-impact systems: migration of key establishment by 2030 and digital signatures by 2031. NISTIR 8547 supports those timelines. The memorandum’s requirements apply to federal systems, while organizations that work with the federal government may also be affected.
NIST advises organizations to inventory their cryptographic systems and examine their cryptographic supply chains, including components provided by vendors. The report also recommends prioritizing data that is especially sensitive or must remain confidential for a long time. For such data, organizations may focus earlier on post-quantum key establishment, including the standard FIPS 203. NIST discusses hybrid approaches that combine conventional and post-quantum cryptography, while noting that this can require more computing resources.
Deadlines Shape Migration Planning
The report turns NIST’s post-quantum standards into a migration framework, giving organizations a clearer basis for deciding what to replace, when to do it and which systems need early attention. Cryptography is embedded in software, hardware, communications and services supplied by outside vendors, so the change is not limited to swapping one algorithm in a single application. Organizations need visibility into where cryptography is used and how dependent systems will be updated.
The timing matters because encrypted information collected today could be stored and decrypted later if quantum technology advances enough to break current protections. NIST identifies this “harvest now, decrypt later” risk as a reason not to wait until such a machine exists. The report does not claim that a cryptanalytically relevant quantum computer is available now; it addresses the need to prepare before one could threaten sensitive information.
For federal agencies, the deadlines set planning milestones. For companies and other institutions, the report offers a reference for assessing exposure and coordinating with federal customers and suppliers. Its guidance on hybrid cryptography also frames a trade-off: combining approaches can provide a more conservative migration path, but it adds computational demands that organizations must evaluate.
Products Worth Considering
DJI Osmo Mobile 8 Gimbal with Mic Mini Transmitter, Infinity Black
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
From 2024 Standards to Migration
In August 2024, NIST released its first set of post-quantum cryptography standards, designed to protect against attacks from future quantum computers. The standards established the algorithms organizations can begin adopting; NISTIR 8547 addresses the next step: how existing standards and systems should move toward them.
The report complements work by NIST’s National Cybersecurity Center of Excellence, which is coordinating a cross-sector project on migration practices. That project is developing demonstrations related to cryptographic visibility, risk management, cryptographic agility and implementations of the post-quantum standards. NIST mathematician Dustin Moody, who leads the agency’s PQC standardization project, said the report explains standards and requirements while the NCCoE effort can show practical tools and blueprints.
“We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing.”
— Dustin Moody, NIST mathematician and head of the PQC standardization project
Implementation Details Still Vary
The report sets broad targets, but organization-specific migration plans will depend on the systems involved, their data, vendors and operational constraints. The supplied information does not identify a single implementation deadline for every private-sector organization, nor does it specify the resources or costs each organization will need. Federal targets should not be read as identical requirements for all businesses.
The timing of a quantum computer capable of breaking current cryptography also remains uncertain. NIST’s report treats future decryption as a security risk to prepare for, not as evidence that such a machine already exists. The performance and suitability of hybrid approaches will likewise depend on particular systems; the source material gives no universal estimate of their computational cost.
Agencies Begin Inventory and Prioritization
Organizations can use the report to identify where quantum-vulnerable algorithms are deployed, map dependencies on suppliers and prioritize data that needs long-term protection. Federal agencies will need to plan against the 2030, 2031 and 2035 targets relevant to their systems. Organizations serving federal customers may need to coordinate with those customers on applicable requirements and timelines.
NIST’s NCCoE project is expected to continue developing demonstrations and practical migration resources, including work on cryptographic visibility and risk management. The report does not set out a single implementation path for all users, so further decisions will depend on system-level assessments, evolving standards and the requirements that apply to each organization.
Key Questions
What is NISTIR 8547?
NISTIR 8547 is NIST’s report on transitioning from quantum-vulnerable cryptographic algorithms to post-quantum standards. It outlines phase-out plans, timelines and factors organizations should consider during migration.
What are the federal migration deadlines?
The broad federal target is 2035. For high-value assets and high-impact systems, the stated targets are 2030 for key establishment and 2031 for digital signatures.
Does the report mean quantum computers can break encryption today?
No. The report addresses the threat from a future, sufficiently powerful quantum computer. It also discusses the risk that adversaries could collect encrypted data now and try to decrypt it later; the source does not say such a computer is currently available.
What should organizations do first?
NIST advises organizations to assess where cryptography is used, examine their cryptographic supply chains and prioritize sensitive information that must stay confidential for a long time. The appropriate sequence will vary by organization.
What is hybrid post-quantum cryptography?
A hybrid approach combines conventional cryptography with post-quantum cryptography. NIST discusses it as one migration option; it can be more conservative from a security standpoint but may require more computing resources.
Source: rss
