NIST IR 8547: the deadlines to retire RSA and elliptic curves

The National Institute of Standards and Technology (NIST) has published the final version of Transition to Post-Quantum Cryptography Standards (NIST IR 8547), the roadmap for retiring the public-key cryptography that a sufficiently powerful quantum computer could break. According to Cybersecurity360, the document was released on 27 October 2026. It builds on the three post-quantum standards NIST published in August 2024 and sets out which algorithms to replace, in what order and on what timeline.

There is no vulnerability to fix and no patch to install. What there is, is an expiry date for RSA, Diffie-Hellman and elliptic curves, and it also affects anyone who sells technology to US government agencies or uses products built for that market.

The timeline: deprecated after 2030, disallowed after 2035

According to Help Net Security and Cybersecurity360, the report sets two phases for quantum-vulnerable public-key cryptography:

• after 2030 the algorithms are deprecated: they may still be used, but data owners must assess the risk and decide whether to continue;
• after 2035 they are disallowed for the purposes covered by NIST standards and guidelines.

For the most sensitive federal systems the dates are closer. Executive Order 14412 of June 2026 and, according to Help Net Security, OMB Memorandum M-26-15 require high-value assets, high-impact systems and other prioritised sensitive systems to adopt:

• post-quantum key establishment by 31 December 2030;
• post-quantum digital signatures by 31 December 2031.

Help Net Security also notes that National Security Memorandum 10 sets 2035 as the target for completing the federal migration, and that Executive Order 14306, together with the same OMB memorandum, requires agencies to support TLS 1.3 by 2 January 2030. NIST, quoted by Infosecurity Magazine, writes that these deadlines “leave little margin” and call for immediate and sustained action, including by technology providers, standards organisations and infrastructure operators.

What to replace, and with what

The report separates the two functions of asymmetric cryptography, which are not interchangeable. According to Cybersecurity360’s summary:

• key establishment: RSA, Diffie-Hellman, ECDH and the other discrete-logarithm schemes give way to FIPS 203 (ML-KEM);
• digital signatures: RSA, ECDSA and EdDSA give way to FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA);
• symmetric encryption: AES and the main hash functions, with adequate parameters, stay and are not part of the migration.

Also according to Cybersecurity360, NIST names ML-KEM-768 as the default ML-KEM configuration; HQC has been selected as a future alternative, but its standard is still being drafted.

Key establishment comes first because of harvest now, decrypt later: encrypted traffic recorded today could be decrypted once a suitable quantum computer exists. Infosecurity Magazine reports that migrating to FIPS 203 is the priority for highly sensitive data or data that must stay protected for a long time. For signatures, the risk only becomes real once such a computer exists, but certificates, firmware and devices stay in service for years and need planning well ahead. According to Infosecurity Magazine, Microsoft has warned that quantum computers capable of breaking asymmetric encryption could arrive sooner than expected, possibly within five years.

Hybrid configurations and the supply chain

NIST allows hybrid configurations, which combine a traditional and a post-quantum algorithm in the same key-establishment operation, so protection holds even if one of the two turns out to be weak. Infosecurity Magazine and Cybersecurity360 report that they require more computing resources; Cybersecurity360 adds engineering complexity and the need for independent testing. Running the two algorithms in separate connections is not a hybrid configuration.

The report also asks organisations to look at their whole cryptographic supply chain, not just their own systems (Infosecurity Magazine). The ability to migrate depends on libraries, HSMs, certificates, protocols and vendor timelines; according to Help Net Security, NIST points out that previous cryptographic transitions have taken 10 to 20 years. Systems that cannot support post-quantum cryptography should be identified and scheduled for replacement or decommissioning. NIST’s National Cybersecurity Center of Excellence is preparing practical migration resources.

Impact for European and Italian companies

The US dates are not obligations for Italian businesses, as Cybersecurity360 stresses, but they affect global vendors and therefore the products you buy. According to Infosecurity Magazine, Cloudflare, Google and Microsoft have set 2029 as the deadline for their own full migration, while Canada, Australia, Japan and the UK have set deadlines between 2028 and 2030 for critical government systems.

For Europe, the reference remains the coordinated roadmap adopted by the Member States in June 2025: start the transition by the end of 2026 and protect high-risk use cases and priority infrastructure by 2030. In Italy, ACN (the national cybersecurity agency) updated its guidelines on cryptographic functions on 11 June 2026, including its recommendations for TLS.

For NIS2 entities, policies on the use of cryptography are already part of the required risk-management measures; in financial services, DORA Delegated Regulation 2024/1774 (Article 6) requires a documented policy on cryptographic controls. Healthcare and public administration, which hold confidential data for decades, are among the sectors most exposed to harvest now, decrypt later.

What to do now

1. Build a cryptographic inventory: algorithms, protocols, certificates and libraries mapped to services, applications and data, including OT, development pipelines and third-party products.
2. Prioritise long-lived data: communications carrying data that must stay confidential for years come first, with post-quantum or hybrid key establishment where available.
3. Move services to TLS 1.3, the version US federal agencies must support by 2 January 2030.
4. Ask your vendors which post-quantum algorithms they support, from when and how they are updated, especially for VPNs, HSMs, network devices, cloud services and long-lived devices.
5. Do not replace what does not need replacing: AES and approved hash functions stay; focus resources on key establishment and signatures.
6. Plan for crypto-agility, the ability to change algorithms without stopping services, and identify the systems to retire because they cannot migrate.

How ARXDOME helps

ARX Expose shows what of your company is visible from the internet, including certificates, open ports and recognised products; with ARX Scout Assessment, once you authorise it, outdated certificates and protocols on your public addresses are checked as well. ARX Sentry collects the inventory of systems and software on monitored machines. Together they give you a starting point for the cryptographic inventory, inside and outside the company.

Last updated: 29 October 2026