TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
NIST has published NISTIR 8547, a road map for replacing quantum-vulnerable cryptographic algorithms with its post-quantum standards. Federal targets include 2035 for most systems, with earlier deadlines for certain high-value and high-impact systems; organizations are advised to assess their systems and suppliers and prioritize sensitive data.
The National Institute of Standards and Technology has published NISTIR 8547, a road map for federal agencies, industry partners and standards organizations to replace cryptographic algorithms vulnerable to future quantum computers with NIST post-quantum cryptography standards. The report supports federal migration targets of 2035 for most systems, with earlier deadlines for key establishment and digital signatures in high-value assets and high-impact systems.
The report identifies quantum-vulnerable algorithms in existing NIST cryptographic standards and describes how they are expected to be phased out. It connects those algorithms to post-quantum standards NIST released in August 2024, giving organizations guidance on which changes are needed and when. The specific work and schedule will vary by organization, while the federal targets provide a broad planning framework.
Federal systems generally have a 2035 target for completing the migration. Under the deadlines described in the source material, high-value assets and high-impact systems have earlier targets: 2030 for key establishment and 2031 for digital signatures. The report supports these dates; federal requirements do not automatically apply to every private organization, although suppliers and other organizations working with the government may be affected.
NIST advises organizations to map their cryptographic systems and supply chains, identify sensitive information that could remain valuable for years, and plan migration priorities. It also discusses hybrid approaches that combine conventional cryptography with post-quantum methods. NIST says this can provide a more conservative security approach, but it uses additional computational resources.
Deadlines Shape Migration Planning
The report gives organizations a shared reference for planning a large, distributed technology change. Cryptography is built into systems, products and services across an organization, and dependencies on suppliers can make a migration more involved than replacing a single algorithm. Identifying where vulnerable cryptography is used can help teams prioritize work and coordinate with vendors before deadlines arrive.
The guidance also connects timelines to the risk that attackers may collect encrypted information now and attempt to decrypt it later if quantum computing advances enough. That “harvest now, decrypt later” risk is especially relevant to data that must remain confidential for a long time. NIST’s example is to consider prioritizing post-quantum key establishment for such information, rather than treating every system as equally urgent.
For organizations serving federal agencies, the government’s targets may affect procurement, product support and system planning. For others, the report is guidance rather than a universal legal deadline. Its value is in helping organizations make decisions based on their data, systems and dependencies, rather than waiting until a capable quantum computer exists.
Popular right now
Philips 3300 Series Fully Automatic Espresso Machine with LatteGo Milk System
DeLonghi Rivelia Automatic Espresso Machine Bundle with Grinder and Frother, Beige
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
From 2024 Standards to Deployment
NIST released its first post-quantum cryptography standards in August 2024, establishing algorithms intended to withstand attacks by a future sufficiently capable quantum computer. NISTIR 8547 follows that standards work by addressing how organizations can move from existing algorithms to the new standards.
The federal schedule described in the report is tied to government policy. National Security Memorandum 10 set 2035 as the main target for federal migration, while Executive Order 14412 brought forward deadlines for key establishment and digital signatures in high-value and high-impact systems. The NIST report sets out how its transition plan relates to those dates.
NIST also points to a separate effort at its National Cybersecurity Center of Excellence. That cross-sector project is working on demonstrations and practical resources for cryptographic visibility, risk management, cryptographic agility and implementation of the post-quantum standards. NIST describes the report as guidance on standards and requirements, while the center’s project is intended to show practical tools and blueprints.
“We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing.”
— Dustin Moody, NIST mathematician and head of the post-quantum cryptography standardization project
Implementation Details Still Vary
The report provides a broad migration plan, but it does not establish one implementation schedule for every organization or system. NIST says the work varies by use case, and the source material does not detail every algorithm-specific phase-out date or how each private organization should sequence its changes.
The dates cited apply to federal systems and designated high-value or high-impact systems. The exact effect on contractors, suppliers and other private organizations will depend on their relationships with federal agencies and applicable requirements. The source material also does not specify when a cryptanalytically relevant quantum computer will be available; the migration is being planned ahead of that possibility.
Hybrid cryptography is presented as an option, not a mandatory approach for all users. Its suitability will depend on system needs and available computing resources. Organizations will need to determine how the report’s guidance applies to their own infrastructure and supply chains.
Organizations Begin Mapping Systems
Organizations can use NISTIR 8547 to identify vulnerable cryptography, inventory dependencies and set migration priorities against the applicable federal timelines. The next practical work includes coordinating with suppliers, evaluating long-lived sensitive data and determining where post-quantum or hybrid implementations fit.
NIST’s National Cybersecurity Center of Excellence is continuing its cross-sector project to demonstrate tools and practices for migration. Those demonstrations are intended to help organizations with visibility into cryptographic use, risk management and implementation planning. The report does not announce a single implementation deadline for all organizations outside the federal targets, so sector-specific requirements and further technical guidance will matter as plans develop.
Key Questions
What is NISTIR 8547?
NISTIR 8547 is a NIST report outlining how organizations can transition from quantum-vulnerable cryptographic algorithms to NIST’s post-quantum standards, including planning considerations and federal timelines.
What are the federal migration deadlines?
The broad federal target is 2035. The source material gives earlier targets for high-value assets and high-impact systems: 2030 for key establishment and 2031 for digital signatures.
Does the report set a deadline for every private company?
No universal private-sector deadline is specified in the source material. The federal targets apply to federal systems, though government contractors and suppliers may be affected by their obligations and relationships with agencies.
Why does the migration matter before quantum computers are ready?
Attackers may collect encrypted data now and try to decrypt it in the future if sufficiently capable quantum computers become available. This risk is especially relevant for information that needs to remain confidential for many years.
Does NIST require organizations to use hybrid cryptography?
No. The report discusses hybrid approaches that combine conventional and post-quantum cryptography as an option. NIST notes that this can be more conservative from a security standpoint but requires additional computing resources.
Source: thequantuminsider.com
