NIST IR 8547 Is Final. Every RSA and ECC Key Size Is Now Deprecated After 2030

On 27 October 2026, NIST published the final version of NIST IR 8547, "Transition to Post-Quantum Cryptography Standards". It replaces the initial public draft of November 2024, which most migration plans, including ours, had been quoting for almost two years.

The headline dates did not move: quantum-vulnerable public-key cryptography is deprecated after 2030 and disallowed after 2035 under NIST standards and guidelines. What moved is which keys the 2030 date applies to.

What changed from the draft

The draft split quantum-vulnerable algorithms by strength. Keys at the 112-bit security level, such as RSA-2048, were to be deprecated after 2030 and disallowed after 2035. Stronger keys, such as RSA-3072, P-256 and P-384, went straight to "disallowed after 2035" with no deprecation stage. Moving to a larger RSA or ECC key looked like a way to buy five years of quiet.

The final report removes that option. Its tables for signatures and key establishment list each family once, from 112 bits of classical security upwards, with the same two dates:

NIST says it plainly: it "will instead deprecate all quantum-vulnerable digital signature algorithms after 2030 and disallow their use under NIST standards and guidelines after 2035". The report also notes that SP 800-57's older plan to disallow 112-bit public-key schemes on 1 January 2031 is superseded by this schedule.

"Deprecated" means the algorithm may still be used, but the user accepts risk and should be migrating. "Disallowed" means it is no longer approved for that purpose. Organisations may keep using deprecated algorithms while they migrate.

What else the final report says

• ML-KEM-768 is the recommended default for key establishment, with ML-KEM-512 and ML-KEM-1024 for constrained or higher-security cases. ML-KEM is currently the only approved post-quantum key-establishment scheme.
• HQC was selected as an alternative to ML-KEM and will be approved once its standard is published. That standard has not been published yet.
• Hybrids are allowed. A combined (hybrid) key-establishment technique can be FIPS 140-validated as long as at least one input comes from an approved scheme, which is how X25519 + ML-KEM deployments stay compliant. SP 800-227 covers key combiners.
• Earlier deadlines still apply where they exist. The report states that the 2030–2035 window "does not alter the earlier deadlines" for US federal high-value assets and high-impact systems under EO 14412 and OMB M-26-15: post-quantum key establishment by 31 December 2030 and signatures by 31 December 2031.
• Symmetric cryptography is mostly fine. Approved symmetric primitives with at least 128 bits of classical security are believed to meet post-quantum category 1. The few 112-bit symmetric standards are disallowed in 2030, and SHA-1 will be disallowed in FIPS-validated modules after 2030.
• Systems that cannot support post-quantum cryptography should be identified and prioritised for replacement or decommissioning.

What did not change

• The two dates: deprecated after 2030, disallowed after 2035.
• The standards to migrate to: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). FN-DSA (FIPS 206) is still not final.
• Nothing in IR 8547 binds a bank outside the US directly.

Why it matters for banks and insurers outside the US

NIST dates reach financial institutions in India, Singapore and the Gulf through the products they buy, even where no local regulator cites them:

• HSMs and cryptographic modules are validated under FIPS 140-3. Once an algorithm is disallowed under NIST guidelines, validated modules follow, and vendors plan their firmware roadmaps around that.
• Cloud KMS, browsers and TLS libraries ship to the same schedule worldwide.
• Regulators converge on similar dates. The EU coordinated roadmap and Germany's national guideline of 12 October 2026 put high-risk systems at end-2030 and a largely complete transition at 2035. India's DST roadmap targets critical infrastructure by 2027–2029, and SAMA's circular asks Saudi institutions for a classified inventory by the end of 2026.

What to do with it

1. Stop treating key size as a migration strategy. An RSA-3072 or P-384 key is now on the same clock as RSA-2048. Plans that deferred "strong" keys need revisiting.
2. Inventory every key size, not only the weak ones. A cryptographic inventory that records only algorithm names cannot tell an RSA-2048 key from an RSA-4096 one, and now it has to list both anyway. Record algorithm, key size, owner and what data each key protects.
3. Ask vendors for dated commitments. For each HSM, payment switch, core-banking component and cloud service: when will it support ML-KEM and ML-DSA, and on which firmware or version?
4. Default new key exchange to hybrid X25519 + ML-KEM-768 where your stack supports it, which addresses harvest-now-decrypt-later exposure first.
5. Keep the 2030 date in front of the board. Deprecation after 2030 is four years away; a bank-wide migration typically takes longer than that.

Qypher inventories the RSA and ECC keys across your public perimeter, code, cloud, binaries and keystores, with key size, owner and the data each one protects, and generates the post-quantum replacements your team deploys. Run a free scan →

Sources: NIST IR 8547 (final), Transition to Post-Quantum Cryptography Standards (27 October 2026); NIST IR 8547 initial public draft (November 2024); NIST SP 800-227; BSI, BMI and BMDS national PQC guideline (12 October 2026).