TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
NIST has published NISTIR 8547, a road map for moving federal agencies and other organizations from quantum-vulnerable cryptography to post-quantum standards. Federal targets include 2035 for most systems, with earlier 2030 and 2031 deadlines for specified high-value assets and high-impact systems.
The National Institute of Standards and Technology has released NISTIR 8547, a road map for replacing cryptographic algorithms that could be threatened by sufficiently powerful quantum computers with post-quantum cryptography standards. The guidance supports federal migration targets of 2035 for most systems, with earlier deadlines for specified high-value assets and high-impact systems.
The report, titled Transition to Post-Quantum Cryptography Standards, describes NIST’s approach to phasing out quantum-vulnerable algorithms in existing standards and shifting to post-quantum algorithms. NIST published its first post-quantum standards in August 2024. The new report is intended to inform federal agencies, industry partners and standards organizations about what changes are needed and how to plan for migration.
Under the federal targets described in the report, 2035 is the main goal for completing migration across federal systems. Earlier requirements apply to high-value assets and high-impact systems: migration for key establishment is targeted by 2030, and migration for digital signatures by 2031. The report supports these dates; the source material does not state that the deadlines apply to every private-sector organization.
NIST advises organizations to inventory their cryptographic systems and supply chains, identify sensitive data that may need protection for many years, and plan migration according to their systems’ needs. It also discusses hybrid approaches that combine conventional cryptography with post-quantum algorithms. NIST says this can provide a more conservative security approach, while requiring additional computing resources.
Why Early Cryptographic Planning Matters
The report gives organizations a framework to begin work before a quantum computer capable of breaking widely used cryptography exists. The concern is not limited to future communications: attackers could collect encrypted information now and attempt to decrypt it later, a risk commonly described as “harvest now, decrypt later.” Data that must remain confidential over a long period may warrant earlier attention.
Migration involves more than changing an algorithm in one application. Organizations may depend on vendors, devices and services that use cryptography in ways they cannot readily see. Mapping that cryptographic supply chain can help identify dependencies and decide which systems to update first. Federal deadlines also matter to companies and other organizations that supply or support federal systems, although the report does not set a universal schedule for all private entities.
The guidance also recognizes trade-offs. Hybrid deployment may add a layer of caution during the move to new standards, but it can increase computational demands. Organizations will need to weigh security needs, system performance and operational constraints rather than assume one migration plan fits every use case.
Products Worth Considering
EcoFlow Smart Home Panel 2 Whole-Home Backup System Hub
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
As an affiliate, we earn on qualifying purchases.
From 2024 Standards to Migration Guidance
NIST’s 2024 post-quantum standards established algorithms designed to withstand attacks from future quantum computers. NISTIR 8547 follows that standard-setting work by addressing the practical transition away from vulnerable algorithms already used in NIST standards. The report describes how those algorithms are expected to be phased out or treated in federal systems over time.
The federal timeline draws on National Security Memorandum 10, which established 2035 as the primary target, and Executive Order 14412, which accelerated deadlines for high-value assets and high-impact systems. NIST says the new report complements a separate migration project at its National Cybersecurity Center of Excellence. That project works with organizations across sectors on demonstrations of cryptographic visibility, risk management and practical implementation.
“We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing.”
— Dustin Moody, NIST mathematician and head of the post-quantum cryptography standardization project
Implementation Details Still Vary
The report sets out federal targets and planning considerations, but organizations’ migration schedules will depend on their systems, data, suppliers and applicable requirements. The source material does not specify a single deadline for all non-federal organizations or provide a complete account of how every algorithm will be treated in every use case.
It is also unclear from the available report summary how quickly individual agencies and vendors will complete inventories, procurement changes and deployment work. NIST’s guidance addresses planning, but the details of implementation—including the resources required for hybrid approaches—will vary. A cryptanalytically relevant quantum computer remains a future possibility; the report does not claim that such a machine currently exists.
Agencies Begin Planning Against Deadlines
Federal agencies and organizations supporting them can use NISTIR 8547 to identify affected cryptography, map vendor and system dependencies, and prioritize migrations against the stated federal dates. Sensitive information that must remain protected for a long time may receive earlier attention because of the harvest-now, decrypt-later risk.
NIST’s National Cybersecurity Center of Excellence is continuing its cross-sector project on migration practices, including demonstrations involving cryptographic visibility, risk management and post-quantum implementations. Those practical demonstrations are intended to complement the report’s standards and planning guidance. The next significant milestones are the 2030 key-establishment target, the 2031 digital-signature target for specified systems, and the broader 2035 federal migration goal.
Key Questions
What is NISTIR 8547?
NISTIR 8547 is NIST’s report describing how organizations can transition from quantum-vulnerable cryptographic algorithms to post-quantum standards.
What are the federal migration deadlines?
The main federal target is 2035. For high-value assets and high-impact systems, the targets are 2030 for key establishment and 2031 for digital signatures.
Do the deadlines apply to every company?
The dates described are federal migration targets. Companies working with or supporting federal systems may be affected, but the source material does not establish one mandatory timeline for every private-sector organization.
Why start migration before a powerful quantum computer exists?
Encrypted data collected today could potentially be decrypted in the future if quantum technology advances enough to threaten current cryptography. This risk is known as “harvest now, decrypt later.”
What does a hybrid cryptography approach mean?
A hybrid approach combines conventional cryptography with post-quantum cryptography. NIST describes it as a more conservative option, while noting that it can require additional computing resources.
Source: thequantuminsider.com
