NIST Releases Final IR 8547 Establishing Definitive Post-Quantum Cryptography Transition Timeline and Deprecation Schedules

Introduction

The National Institute of Standards and Technology (NIST) has published its final technical roadmap, IR 8547 – Transition to Post‑Quantum Cryptography Standards. The document translates the requirements of the White House Executive Order 14412 and OMB Memorandum M‑26‑15 into concrete deadlines and migration guidance for federal high‑value assets (HVAs) and the broader IT ecosystem. By establishing clear deprecation dates for classical public‑key algorithms and approving hybrid and pure post‑quantum (PQC) mechanisms, NIST aims to mitigate the long‑term risk of “Harvest‑Now‑Decrypt‑Later” (HNDL) attacks.

Key‑Establishment Timeline and Targets

• Deadline for federal HVAs: December 31 2026 — all key‑establishment operations must use PQC by the end of 2030, with a hard cut‑off for classical algorithms in 2035.
• Approved PQC KEMs: ML‑KEM (default ML‑KEM‑768) and the emerging HQC algorithm.
• Hybrid allowance: NIST updates SP 800‑56C and SP 800‑227 to permit concatenating a PQC secret (e.g., ML‑KEM) with a classical secret (e.g., ECDH) into a composite key (Z′ = Z‖T). This hybrid remains valid under FIPS 140 validation even if one component is a legacy algorithm.
• TLS migration: Federal agencies must enforce TLS 1.3 by January 2 2030, encouraging immediate deployment of hybrid key‑exchange suites that pair ML‑KEM with Diffie‑Hellman.

Digital‑Signature Migration Path

• Deadline for federal HVAs: December 31 2026 — digital signatures must transition to PQC by the end of 2031, with deprecation of classical schemes beginning in 2031 and a final ban in 2035.
• Approved PQC signature schemes: ML‑DSA (FIPS 204), SLH‑DSA (FIPS 205), and the forthcoming FN‑DSA.
• Hybrid signatures: Dual‑signature constructions that combine a classical algorithm (RSA, ECDSA, EdDSA) with a PQC algorithm are permissible, provided at least one component is NIST‑approved. This approach eases the replacement of PKI certificates, root CAs, PIV smart cards, and HSMs.
• Stateful signatures: LMS, HSS, XMSS, and XMSSMT remain approved for specialized uses such as secure‑boot signing, acknowledging their higher operational overhead.

Symmetric and Hash Primitives

• Quantum‑resistant ciphers: AES‑128/192/256 (FIPS 197) and SHA‑2/SHA‑3 continue to meet Category 1‑5 quantum‑resistance criteria and remain approved.
• Legacy symmetric primitives: 112‑bit algorithms will be disallowed after 2030.
• Asymmetric composites: SP 800‑56C and SP 800‑227 now explicitly support composite modes that blend PQC and classical secrets, facilitating gradual migration without breaking existing FIPS 140 validation.

Enterprise Implications and Tooling

The release of IR 8547 triggers a regulatory push for commercial vendors to provide migration‑management solutions. Early adopters are offering:

• Automated discovery of cryptographic artifacts across codebases and network traffic.
• Cryptography Bills of Materials (CBOMs) to inventory and track algorithm usage.
• Hybrid traffic mediation that routes legacy connections through PQC‑enabled gateways while preserving compliance.
• Accelerated CMVP validation for native implementations of FIPS 203 (ML‑KEM), 204 (ML‑DSA), and 205 (SLH‑DSA).

Practical Steps for Organizations

1. Inventory all public‑key uses (TLS, VPN, code signing, PKI) and map them to the relevant deadline.
2. Prioritize key‑establishment upgrades to meet the 2030 target; deploy hybrid KEMs where pure PQC is not yet supported.
3. Plan signature migration for 2031, starting with dual‑signature pilots in non‑critical systems.
4. Leverage vendor tooling to generate CBOMs and automate compliance reporting.
5. Engage with CMVP early to validate PQC implementations and avoid bottlenecks during the 2035 deprecation window.

Conclusion

NIST’s IR 8547 provides a definitive, time‑bound roadmap for moving the United States—and its global partners—away from quantum‑vulnerable public‑key cryptography. By coupling firm deadlines with flexible hybrid mechanisms, the agency balances security urgency against the practical realities of large‑scale PKI replacement. Organizations that begin inventorying, testing, and deploying approved PQC algorithms now will be best positioned to meet the 2030‑2035 transition milestones and safeguard data against future quantum threats.