Reports

NIST IR 8547 is final. 2030 is now a date, not a mood.

by Simon McCorkindale

NIST has published the final version of its post-quantum transition roadmap. Every quantum-vulnerable public-key algorithm is deprecated after 2030 and disallowed after 2035, and US federal high-value systems get harder deadlines still. New Zealand still has none of its own.

Reference: Moody D, Perlner R, Regenscheid A, Robinson A, Cooper D. Transition to Post-Quantum Cryptography Standards, NIST IR 8547 (October 2026). doi:10.6028/NIST.IR.8547

On 27 October, NIST published the final version of IR 8547, the document that turns its 2024 post-quantum standards into a timetable. The draft circulated in late 2024. The final version lands after a US Executive Order and an OMB memorandum have both put specific dates on federal migration, and it reads accordingly: less “here is our thinking”, more “here is the calendar”.

NIST’s own report notes that moving from a standardised algorithm to full deployment has historically taken 10 to 20 years. The deadlines in it are four to five years away. NIST does the arithmetic itself and concludes, politely, that there is not much margin.

What the final report says

Everything quantum-vulnerable is deprecated after 2030. RSA, ECDSA and EdDSA signatures, and finite-field and elliptic-curve Diffie-Hellman key exchange, are all deprecated after 2030 and disallowed under NIST standards after 2035. The final version applies the 2030 deprecation across the board, rather than reserving it for the weakest 112-bit parameter sets. “Deprecated” in NIST’s vocabulary means you may still use it, but the data owner explicitly carries the risk. It is NIST for “on your own head be it”.

The US federal clock runs faster. Under Executive Order 14412 and OMB Memorandum M-26-15 (both June 2026), federal high-value assets and high-impact systems must use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. The same priority applies to any system holding data expected to remain sensitive in 2030, which is the harvest-now-decrypt-later (HNDL: adversaries recording encrypted traffic today to decrypt once a capable quantum computer exists) logic written into policy. Agencies must also support TLS 1.3 by 2 January 2030, and systems that cannot support PQC are to be flagged for replacement or decommissioning.

ML-KEM-768 is the recommended default. NIST names ML-KEM-768 (the mid-strength parameter set of FIPS 203, the lattice-based key-encapsulation standard) as its default for key establishment. HQC is coming as a backup KEM, and a Falcon-derived signature standard is in development. Hybrid key exchange (classical plus post-quantum, the two-padlocks approach) can be FIPS 140-validated as long as one component is NIST-approved, but the report is clear that hybrids are expected to be a temporary step before a second, PQC-only transition.

Symmetric cryptography mostly survives. AES-128 and above, SHA-256 and friends stay. Only the remaining 112-bit symmetric options are disallowed in 2030, and SHA-1 leaves FIPS-validated modules after 2030. Pop the champagne: your AES-256 backups are fine. The keys that were exchanged to protect them in transit are another matter.

Caveats

This is a US federal document. It binds nobody in Wellington. “Disallowed after 2035” applies under NIST standards and guidelines, not to the internet at large. Several pieces it leans on (SP 800-131A, the TLS guidance in SP 800-52, the key-derivation rules in SP 800-56C) are still to be revised, and NIST says it will adjust timelines as things change. Treat the dates as a strong reference point, not a law of physics.

The NZ read

The report describes itself as a blueprint not only for US agencies but for critical infrastructure owners and operators doing the same migration. That matters here, because New Zealand remains the only Five Eyes member without a formal PQC migration deadline. The DPMC critical infrastructure consultation made no substantive mention of cryptography, and the Critical Infrastructure Bill has yet to appear. When it does, IR 8547 is the obvious document to borrow dates from.

Measured against NIST’s calendar, our June 2026 re-scan of 118 NZ critical infrastructure entities looks like this:

  • 52.2% negotiate PQC, but most of that is CDN-delivered. Only 25 entities run PQC at their own origin, and 49 classical origins have not moved.
  • Nine endpoints are still TLS 1.2-only. US agencies must reach TLS 1.3 by January 2030 because it is the practical route to X25519MLKEM768 (the hybrid key exchange browsers now use). Those nine would be non-compliant before the migration even began.
  • Energy grid operators, water and transport have zero origin PQC. Among the big-four banks plus Kiwibank, only ANZ does.
  • Post-quantum signatures are nowhere yet. That is expected (the US federal deadline is 2031), but it is the slower, more coordinated half of the job, which is exactly why NIST says not to leave it until last.

The US “data still sensitive in 2030” test maps neatly onto New Zealand’s long-retention sectors: health records, legal files, engineering IP, and anything held under AML/CFT’s seven-year obligations. Data encrypted with classical key exchange today and retained to 2033 sits squarely in the window NIST is worried about. For the AU-owned banks, the decision will likely be made in Sydney or Melbourne, against Australian and US timelines, whether or not Wellington sets one.

A pragmatic NZ reading: adopt 2030 for key establishment and 2031 for signatures as internal targets, finish the cryptographic inventory now, get every endpoint onto TLS 1.3, and ask your vendors (CDNs included) to show their PQC roadmap against NIST’s dates in writing. Waiting for a local mandate is a strategy, but not a time-efficient one.

Kaysec is the post-quantum security practice of Spinsphere, a New Zealand-based quantum technology company. We help NZ organisations with cryptographic inventory, HNDL risk assessment, TLS configuration auditing, PQC migration planning, and NZISM Section 2.4 alignment. Get in touch.

If it lives long, protect it.

References

  1. Moody D, Perlner R, Regenscheid A, Robinson A, Cooper D (2026). Transition to Post-Quantum Cryptography Standards. NIST IR 8547, October 2026. https://doi.org/10.6028/NIST.IR.8547
  2. NIST (27 October 2026). NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards. https://www.nist.gov/news-events/news/2026/10/nist-report-provides-guidelines-transition-post-quantum-cryptography
  3. Executive Order 14412 (22 June 2026). Securing the Nation Against Advanced Cryptographic Attacks. https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/
  4. Office of Management and Budget (24 June 2026). Execution of the Migration to Post-Quantum Cryptography, M-26-15. https://www.whitehouse.gov/wp-content/uploads/2026/06/M26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf
  5. NIST (2024). FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard. https://csrc.nist.gov/pubs/fips/203/final
  6. Kaysec (15 April 2026). NZ Critical Infrastructure: First Public PQC Readiness Assessment. https://kaysec.spinsphere.xyz/nz-critical-infrastructure-post-quantum-security-readiness-assessment/
  7. Kaysec (3 June 2026). Seven Weeks Later: NZ Critical Infrastructure PQC — The June 2026 Update. https://kaysec.spinsphere.xyz/seven-weeks-later-nz-critical-infrastructure-pqc-the-june-2026-update/