cryptography · 3 min read
NIST IR 8547: RSA gets a retirement date
On October 27, 2026, a twenty-six-page document went up on the NIST website under the designation NIST Internal Report 8547. The title — Transition to Post-Quantum Cryptography Standards — was the kind of bureaucratic phrase that gets filed and forgotten. But two dates inside it will outlast everything else published that week: after December 31, 2030, RSA is deprecated. After December 31, 2035, it is disallowed.
Dustin Moody, the NIST mathematician who had spent the previous decade running the agency’s post-quantum cryptography evaluation, had seen sixty-nine proposals come in during the first call for submissions in 2016. Seven finalists emerged. Three were standardized in August 2024 as FIPS 203, 204, and 205. IR 8547 was the document that followed them with a calendar: the formal decree that RSA, Diffie-Hellman key exchange, ECDSA, and EdDSA — the algorithms that have secured almost every encrypted connection on the internet since the late 1970s — now have expiration dates under U.S. federal standards.
The replacements were already in hand. ML-KEM (FIPS 203) handles key encapsulation, built on lattice mathematics that even a quantum computer cannot easily unwind. ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) cover digital signatures. The report designates ML-KEM-768 as the default configuration. For the duration of the transition — which could run through 2035 — hybrid schemes pairing a post-quantum algorithm with a classical one remain valid under FIPS 140, provided at least one component is post-quantum. Organizations can run two locks on the door while they rebuild the door.
The biggest surprise in the final document was a quiet tightening. The November 2024 draft had given higher-strength classical algorithms — P-256, RSA-3072, Ed25519 — a pass on the intermediate step: they were simply disallowed after 2035, with no deprecation phase. The final report deprecates all of them after 2030 as well. NIST received twenty-five written comments during the review period from Bosch, Ericsson, Infineon, Intel, Thales, and individual cryptographers; some of those teams had built migration roadmaps around the draft’s more lenient treatment of the stronger key sizes. Moody acknowledged the tension plainly: “Migration requirements differ across use cases.”
The urgency behind the 2030 deadline is not theoretical. Adversaries have been collecting encrypted internet traffic for years on a specific wager: that a quantum computer capable of breaking RSA will exist before the collected data expires. Harvest now, decrypt later. IR 8547 is NIST’s formal acknowledgment that this threat has graduated from the theoretical register to the scheduling one.
The mathematics of RSA has not changed. The trapdoor function that Rivest, Shamir, and Adleman built in 1977 is still intact. What changed is the estimate of how long it will stay that way — and the government’s judgment that fifty-year-old arithmetic no longer gets the benefit of the doubt.
Sources
- NIST Releases Final IR 8547 — Quantum Computing Report — deprecation and disallowment deadlines, algorithm tables, the twenty-five-comment review period
- NIST IR 8547 Final: What Changed From the Draft — postquantum.com — comparison of draft vs. final, the tightening of timelines for P-256 and RSA-3072, hybrid-scheme FIPS 140 guidance
- NIST Post-Quantum Cryptography Standardization — Wikipedia — process history from 2016, sixty-nine submissions, finalists, FIPS 203/204/205 finalization