NIST Sets Deadlines for Post-Quantum Cryptography Migration

The National Institute of Standards and Technology released a technical framework and Internal Report 8547 on October 27, 2026, establishing a roadmap for transitioning federal agencies and industry partners to post-quantum cryptography (PQC). The agency will deprecate all quantum-vulnerable digital signature algorithms after 2030 and officially disallow their use under NIST standards and guidelines after 2035.

To counter "harvest now, decrypt later" threats, where adversaries collect encrypted data to decrypt once quantum computers mature, the agency has accelerated deadlines for high-value assets and high-impact systems. Under Executive Order 14412, these systems must migrate key establishment by December 31, 2030, and digital signatures by December 31, 2031. This shortens the previous 2035 goal set by National Security Memorandum 10.

NIST suggests using hybrid systems that combine conventional and PQC algorithms to maintain interoperability, though it warns these increase cost and architectural complexity. The framework prioritizes four use cases: code signing, asymmetric key user sign-in, data transmission over public networks, and email or document encryption. While the Office of Management and Budget has ordered agencies to migrate quantum risk by 2030, a Government Accountability Office report from October 6 found that none of 24 reviewed Chief Financial Officers Act agencies had fully addressed preparatory practices for the migration.