--- title: "RSA and ECC now have NIST end dates: deprecated after 4 more years, disallowed after 9" summary: "What NIST IR 8547, final on 27 October, and the US, NSA, UK, EU and Indian timetables say about retiring RSA and elliptic-curve cryptography, as of 2 November 2026." url: https://www.thetechbag.com/blog/post-quantum-deadlines-nist-2030-2035 format: Analysis desk: "Security" area: "Risk & compliance" region: Global published: 2026-11-02 facts_checked: 2026-11-02 author: TechBag (The TechBag Journal) tags: ["post-quantum cryptography","NIST IR 8547","ML-KEM","ML-DSA","SLH-DSA","FIPS 203","CNSA 2.0","Executive Order 14412","OMB M-26-15","NCSC","TLS 1.3","X25519MLKEM768","Cloudflare","CBOM","CERT-In","DST","National Quantum Mission"] cover: https://www.thetechbag.com/blog/covers/post-quantum-deadlines-nist-2030-2035.png --- # RSA and ECC now have NIST end dates: deprecated after 4 more years, disallowed after 9 *What NIST IR 8547, final on 27 October, and the US, NSA, UK, EU and Indian timetables say about retiring RSA and elliptic-curve cryptography, as of 2 November 2026.* Analysis · Security · Risk & compliance · By TechBag · Published 2026-11-02 · Facts checked 2026-11-02 · Canonical: https://www.thetechbag.com/blog/post-quantum-deadlines-nist-2030-2035 The short version 1. NIST’s final transition report, published 27 October, deprecates every quantum-vulnerable public-key algorithm (RSA, ECDSA, EdDSA, Diffie-Hellman and its elliptic-curve forms) after 2030 and disallows them under NIST standards after 2035. The 2024 draft had deprecated only the weakest tier.[1][3] 2. US federal high-value and high-impact systems must use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. New US national-security purchases must meet NSA’s CNSA 2.0 from 1 January 2027.[4][7] 3. India has no binding post-quantum deadline. A government task-force roadmap of May 2026 recommends 2029 for critical sectors and 2033 for other enterprises, and says it is not a mandate. Start with an inventory and the vendor questions in section 5.[15] Almost every encrypted connection and digital signature in use today rests on RSA or elliptic-curve cryptography, which a large enough quantum computer could break. Until last week the dates for retiring them were a draft. They are now final for the US government, and the UK, the EU and India have published timetables of their own. The question for a buyer is which of these dates touches the products you are buying now, and what to ask the vendor before you sign. ## The final plan: deprecated after 2030, disallowed after 2035 NIST published the final version of IR 8547, *Transition to Post-Quantum Cryptography Standards*, on 27 October 2026. Its central sentence reads: “NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035.”[1][2] In NIST’s terms, deprecated means the algorithm “may be used, but there is some security risk”, and the data owner decides whether to accept it. Disallowed means it is “no longer allowed for the stated purpose”.[1] The final is stricter than the draft of 12 November 2024. The draft deprecated only algorithms at 112 bits of classical security strength and left stronger keys acceptable until 2035.[3] The final’s tables apply “Deprecated after 2030” to every quantum-vulnerable signature and key-establishment family at 112 bits or more, so a larger RSA or elliptic-curve key no longer extends the schedule.[1] **Figure: Federal high-value systems, national-security buyers and contractors all face dates years before NIST’s 2035 cut-off** *Post-quantum dates in US federal policy and NIST guidance, June 2026 to December 2035* | Date | Event | Detail | | --- | --- | --- | | Jun 2026 | Executive Order 14412 | Sets the 2030 and 2031 deadlines for federal high-value assets and high-impact systems; OMB M-26-15 follows on 24 June | | Oct 2026 | NIST IR 8547 final | Quantum-vulnerable public-key algorithms deprecated after 2030, disallowed after 2035 | | Dec 2026 | FAR proposed rule due | Within 180 days of the order: a rule requiring covered contractors to comply with FIPS, including post-quantum, by 31 December 2030 | | Jan 2027 | CNSA 2.0 for new NSS buys | New National Security System acquisitions to be CNSA 2.0 compliant unless otherwise noted | | Jan 2030 | TLS 1.3 required | Federal agencies must support TLS 1.3 or a successor no later than this date | | Dec 2030 | Post-quantum key establishment | Federal high-value assets and high-impact systems; NSA expects equipment that cannot support CNSA 2.0 phased out | | Dec 2031 | Post-quantum signatures | Federal high-value assets and high-impact systems; CNSA 2.0 algorithms mandated for national security systems | | Dec 2035 | Disallowed after 2035 | Quantum-vulnerable public-key algorithms disallowed under NIST standards; the 2035 federal goal of NSM-10 | Source: Executive Order 14412; OMB M-26-15; NIST IR 8547 (final); NSA CNSA 2.0 FAQ v2.1; FAR date is TechBag arithmetic (180 days after 22 June 2026) · as of 2 November 2026 For the most sensitive federal systems the 2030 window does not apply. Executive Order 14412 of 22 June 2026 requires high-value assets and high-impact systems to move key establishment to post-quantum algorithms by 31 December 2030 and signatures by 31 December 2031.[4] OMB’s memorandum M-26-15 of 24 June adds TLS 1.3 support by 2 January 2030 and tells agencies to align their plans with IR 8547.[5] The order also gave the FAR Council 180 days to propose a rule requiring covered contractors to comply with FIPS, “including all applicable FIPS incorporating PQC compliant algorithms”, by 31 December 2030.[4] National security systems are excluded from the order and follow NSA: from 1 January 2027 new acquisitions must meet CNSA 2.0 “unless otherwise noted”.[7] TechBag countTechBag arithmetic The order is dated 22 June 2026; 180 days later is 19 December 2026. That is the deadline for the FAR Council to *propose* the contractor rule, not the date contractors must comply, which the order sets at 31 December 2030. ## What goes, and what replaces it: one key-exchange standard, three signature options IR 8547 lists six quantum-vulnerable families across signatures and key establishment, all on the same schedule. For key establishment, “ML-KEM is the only approved post-quantum key-establishment scheme based on public-key cryptography”, and NIST recommends ML-KEM-768 as the default parameter set. HQC has been selected as an alternative; its FIPS is still being written.[1] FIPS 203, 204 and 205 were published on 13 August 2024.[6][17] **Figure: Every RSA and elliptic-curve scheme in NIST’s standards has a replacement; symmetric encryption largely stays** *Quantum-vulnerable algorithms in NIST standards and their approved replacements, NIST IR 8547 final, October 2026* Quantum-vulnerable: deprecated after 2030, disallowed after 2035 - RSA signatures (FIPS 186) - ECDSA and EdDSA signatures (FIPS 186) - Finite-field Diffie-Hellman and MQV (SP 800-56A) - Elliptic-curve Diffie-Hellman (ECDH) and MQV (SP 800-56A) - RSA key transport and agreement (SP 800-56B) Approved replacements - ML-KEM (FIPS 203) for key establishment; ML-KEM-768 the default - ML-DSA (FIPS 204) for signatures - SLH-DSA (FIPS 205), hash-based signatures - LMS and XMSS (SP 800-208), stateful, for software and firmware signing - AES, SHA-2 and SHA-3 at 128 bits and above: no transition expected Source: NIST IR 8547 (final), Tables 2 to 5 and section 4.1.3 · as of 27 October 2026 Two details matter for products. Hybrid key exchange, which runs a classical and a post-quantum algorithm together, can still be FIPS 140-validated “as long as at least one of the inputs” comes from an approved scheme. And symmetric algorithms at the 112-bit level will be disallowed in 2030, with SHA-1 disallowed in FIPS-validated modules after 2030.[1] NSA asks more of national security systems: ML-KEM-1024 and ML-DSA-87 at every classification level, and it “will not require” hybrid products.[7] ## Outside the US federal market, the roadmaps converge on 2035 The UK’s National Cyber Security Centre published three milestones on 20 March 2025: discovery and an initial plan by 2028, the highest-priority migrations by 2031, and migration of “all your systems, services and products” by 2035.[8] The EU’s coordinated roadmap, published on 23 June 2025, asks member states to start national transitions by 31 December 2026, finish high-risk use cases by 31 December 2030 and medium-risk ones by 31 December 2035.[9] India’s task-force roadmap is the fastest of these, and it is a recommendation, not a mandate.[15] **Figure: Four roadmaps end in 2035; India’s recommended timetable for critical sectors ends six years sooner** *Years from the end of 2026 to each published milestone, by roadmap; a milestone given as a year is placed at that year’s end* UK, all organisations 2 3 4 9 years EU member states 4 5 9 years US federal high-value systems 4 4 9 years US national security systems 5 4 9 years India, enterprises (recommended) 2 2 3 7 years India, critical sectors (recommended) 3 years | | To first milestone | Then to second | Then to final | | --- | --- | --- | --- | | UK, all organisations | 2 | 3 | 4 | | EU member states | 0 | 4 | 5 | | US federal high-value systems | 4 | 1 | 4 | | US national security systems | 0 | 5 | 4 | | India, enterprises (recommended) | 2 | 2 | 3 | | India, critical sectors (recommended) | 1 | 1 | 1 | Source: UK NCSC; EU PQC Workstream roadmap v1.1; Executive Order 14412 and OMB M-26-15; NSA CNSA 2.0 FAQ v2.1; DST Quantum-Safe Ecosystem in India; TechBag count · as of 2 November 2026 · India's milestones are recommendations; the national security row starts on 1 January 2027, shown as zero TechBag countHow we placed the milestones UK: 2028, 2031, 2035. EU: 2026, 2030, 2035. US federal: key establishment 2030, signatures 2031, full migration 2035 (OMB’s phase 5). US national security: new acquisitions from 1 January 2027, CNSA 2.0 mandated end-2031, all systems quantum-resistant by 2035. India: critical sectors 2027, 2028, 2029; enterprises 2028, 2030, 2033. Each bar is the sum of the gaps, so its length is the years left to the final milestone. ## Browsers have mostly switched; the servers behind them have not On the public web the client side moved before the rules did. Google said on 13 September 2024 that Chrome 131 would switch its hybrid post-quantum key exchange from the pre-standard Kyber to ML-KEM.[13] Apple says TLS connections in iOS 26, iPadOS 26, macOS Tahoe 26 and visionOS 26 “will automatically advertise support” for hybrid key exchange.[14] Cloudflare measured about two per cent of its TLS 1.3 connections as post-quantum in March 2024, over 65% of human traffic in April 2026, and over two-thirds of browser traffic in June 2026.[12][11][18] **Figure: About 70 in 100 browser connections to Cloudflare use hybrid ML-KEM; about 15 in 100 of the servers behind it do** *Share using hybrid ML-KEM key agreement on each leg of a Cloudflare connection, as published 29 September 2026* 70% Browser traffic reaching Cloudflare visitor to Cloudflare 15% Origin servers Cloudflare connects to Cloudflare to the customer's server Source: Cloudflare, Is your domain using post-quantum encryption? (Cloudflare Radar) · as of 29 September 2026 · Cloudflare's own measurement of its network; it does not describe the rest of the internet The gap is the part a buyer controls. Cloudflare reports roughly 70% of browser-generated traffic reaching it protected with hybrid ML-KEM, but “just about 15% of origins that Cloudflare connects to use hybrid ML-KEM”. It names X25519MLKEM768 as “the only recommended algorithm for post-quantum encryption” in TLS 1.3.[10] Each of those origins is a web server, load balancer or appliance someone bought. Authentication is a separate problem: Cloudflare’s own target for post-quantum security, “including, crucially, post-quantum authentication”, is 2029.[11] Our view Our view: outside US federal contracts, the first dates that touch most buyers are commercial ones. Browsers already offer hybrid key exchange, so a server, load balancer or firewall that cannot accept it is now the weak link in the connection. Signatures and certificates come later and take longer, because every party that checks a signature has to move together. ## What to ask a vendor now: six questions IR 8547 tells organisations to begin “with cryptographic inventories, migration planning, and early deployments of PQC-enabled products and services”, and says hardware vendors should start integrating post-quantum support “immediately” because of long design and fabrication lead times.[1] For a buyer that becomes a set of questions to put in writing at the next purchase or renewal. They are questions, not a test any named product passes or fails. **Figure: Ask for the inventory first, then a dated answer on key exchange, signatures, hardware and agility** *Questions for vendors of software, appliances and cloud services that use public-key cryptography, November 2026* Step 1 of 6 1. Where is RSA or elliptic-curve used? Ask for a cryptographic bill of materials (CBOM): algorithms, key sizes, protocols and libraries, per component. Source: NIST IR 8547 (final); OMB M-26-15; CERT-In BOM guidelines v2.0, section 8.5; TechBag analysis · as of 2 November 2026 The last question has an Indian source. CERT-In’s bill-of-materials guidelines suggest “tiered vendor Post-Quantum Cryptography (PQC) contractual requirements”, with quarterly migration progress reports carrying executive attestation and a quantum-safe proof of concept before contract renewal.[16] For cloud services, OMB tells US agencies to agree post-quantum responsibilities with providers “within the shared responsibility model”, a useful clause for any buyer.[5] Our [encryption and rights management guide](https://www.thetechbag.com/browse/data-security-privacy/encryption-rights) lists the key-management and HSM products to put these questions to. If you are buying this in India No Indian regulator has set a binding post-quantum deadline. The most detailed Indian document is *Quantum-Safe Ecosystem in India: Roadmap to Quantum Resiliency* (May 2026), from a task force under the Department of Science and Technology’s National Quantum Mission. It recommends that critical sectors, including government, defence, power, telecom, transport and BFSI, build foundations by 31 December 2027, migrate high-priority systems by 31 December 2028 and complete adoption by 31 December 2029. Other enterprises get 2028, 2030 and 2033, and vendors would submit CBOMs from FY 2027–28.[15] The report states that it “does not constitute a legal or regulatory mandate”, leaves enforcement to sectoral regulators, and recommends sending the report to SEBI, RBI and CERC “to initiate sector-specific guidance”.[15] We found no RBI, SEBI, DoT or MeitY circular or direction that sets a post-quantum date as of 2 November 2026. CERT-In’s technical guidelines of 9 July 2025 define a cryptographic and a quantum bill of materials and the vendor clauses quoted above, but they give no deadline.[16] The Indian buyer’s action is therefore the same as everyone else’s, without the date: an inventory of where RSA and elliptic-curve keys sit, the six vendor questions, and a migration clause at each renewal. An Indian IT or software firm selling to US federal agencies has a real date: the FAR rule the executive order calls for would require covered contractors to comply by 31 December 2030.[4] No price is involved in any of this; where a vendor charges for a post-quantum upgrade, ask for it in writing with GST at 18% shown. How we did this Figures as of 2 November 2026 Every NIST date and quotation is from the final IR 8547 PDF (October 2026) and was checked against the initial public draft of November 2024 for what changed. Federal deadlines are from the executive order’s text on govinfo and OMB M-26-15. The 19 December 2026 date is our arithmetic from the order’s “within 180 days”. NSA’s dates are from the CNSA 2.0 FAQ, version 2.1 of December 2024; media.defense.gov refused our requests, so we read an Internet Archive copy of the same file. The DST roadmap was read from an Internet Archive capture of 14 July 2026 because its dst.gov.in address now returns an error. The milestone chart counts years from the end of 2026 and places a year-only milestone at that year’s end. Cloudflare’s shares are its own measurements of its network on different bases (TLS 1.3 connections in 2024, human or browser traffic in 2026). Left out as unverified: national deadlines quoted in coverage for Canada, Australia and Japan, and any RBI or SEBI statement not published as a circular. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [NIST, IR 8547 (final), Transition to Post-Quantum Cryptography Standards (Moody, Perlner, Regenscheid, Robinson, Cooper)](https://csrc.nist.gov/pubs/ir/8547/final) — 27 October 2026 2. [NIST, NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards](https://www.nist.gov/news-events/news/2026/10/nist-report-provides-guidelines-transition-post-quantum-cryptography) — 27 October 2026 3. [NIST, IR 8547 initial public draft, Tables 2 and 4](https://csrc.nist.gov/pubs/ir/8547/ipd) — 12 November 2024 4. [The White House, Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (DCPD-202600417)](https://www.govinfo.gov/app/details/DCPD-202600417) — 22 June 2026 5. [OMB, Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography](https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf) — 24 June 2026 6. [NIST, NIST Releases First 3 Finalized Post-Quantum Encryption Standards (FIPS 203, 204, 205)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards) — 13 August 2024 7. [NSA, The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ, version 2.1 (read via Internet Archive)](https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF) — December 2024 8. [UK National Cyber Security Centre, Timelines for migration to post-quantum cryptography](https://www.ncsc.gov.uk/guidance/pqc-migration-timelines) — 20 March 2025 9. [EU PQC Workstream (NIS Cooperation Group), A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, v1.1](https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography) — 23 June 2025 10. [Cloudflare, Is your domain using post-quantum encryption? Now you can see for yourself](https://blog.cloudflare.com/post-quantum-visibility/) — 29 September 2026 11. [Cloudflare, Cloudflare targets 2029 for full post-quantum security](https://blog.cloudflare.com/post-quantum-roadmap/) — 7 April 2026 12. [Cloudflare, The state of the post-quantum Internet](https://blog.cloudflare.com/pq-2024) — 5 March 2024 13. [Google Security Blog, A new path for Kyber on the web (Chrome 131 moves to ML-KEM)](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html) — 13 September 2024 14. [Apple, Prepare your network for quantum-secure encryption in TLS](https://support.apple.com/en-us/122756) — 18 June 2026 15. [Department of Science and Technology, National Quantum Mission, Quantum-Safe Ecosystem in India: Roadmap to Quantum Resiliency (read via Internet Archive)](https://dst.gov.in/sites/default/files/Quantum-Safe-Ecosystem-in-India.pdf) — May 2026 16. [CERT-In, Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, version 2.0, section 8](https://www.cert-in.org.in/PDF/TechnicalGuidelines-on-SBOM,QBOM&CBOM,AIBOM_and_HBOM_ver2.0.pdf) — 9 July 2025 17. [NIST, FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard](https://csrc.nist.gov/pubs/fips/203/final) — 13 August 2024 18. [Cloudflare, The White House's post-quantum executive order is an important milestone](https://blog.cloudflare.com/post-quantum-eo-2026/) — 23 June 2026 Related on TechBag: the [encryption and rights management guide](https://www.thetechbag.com/browse/data-security-privacy/encryption-rights) compares the key-management and HSM products; [our encryption analysis](https://www.thetechbag.com/blog/comprehensive-data-encryption) covers what the 2024 draft meant for keys and HSMs; and [the certificate-lifetime piece](https://www.thetechbag.com/blog/certificates-200-days-renewals-multiply) covers the TLS renewals that post-quantum certificates will ride on. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Encryption & rights management guide](https://www.thetechbag.com/browse/data-security-privacy/encryption-rights) — the key-management and HSM products to put the post-quantum questions to - [2 of 18 encryption tools protect a file after it leaves](https://www.thetechbag.com/blog/comprehensive-data-encryption) — what the 2024 draft of the NIST schedule meant for keys and HSMs - [Certificates now last 200 days, then 47](https://www.thetechbag.com/blog/certificates-200-days-renewals-multiply) — the TLS certificate renewals post-quantum certificates will ride on