TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
NIST has published NISTIR 8547, a road map for moving from quantum-vulnerable algorithms to its post-quantum cryptography standards. Federal targets include 2035 for most systems, with earlier deadlines for key establishment and digital signatures in high-value assets and high-impact systems.
The National Institute of Standards and Technology has released NISTIR 8547, a road map for replacing cryptographic algorithms vulnerable to future quantum computers with post-quantum cryptography standards. The report supports federal migration targets of 2035 for most systems, with deadlines of 2030 for key establishment and 2031 for digital signatures in high-value assets and high-impact systems.
The report, titled Transition to Post-Quantum Cryptography Standards, identifies quantum-vulnerable algorithms in existing NIST standards and sets out how they are to be phased out in favor of post-quantum algorithms NIST published in 2024. It is intended to guide federal agencies, industry partners and standards organizations, while recognizing that the work and schedule will vary across organizations and systems.
NIST says organizations should inventory their cryptographic systems and consider the supply chains supporting them. It also recommends prioritizing data that is sensitive or must remain confidential for a long time. That priority reflects the “harvest now, decrypt later” risk: adversaries could collect encrypted data now and attempt to decrypt it if sufficiently capable quantum computers become available in the future.
The report discusses hybrid approaches that combine conventional cryptography with post-quantum methods. NIST says this can provide a more conservative security approach during migration, but may require additional computing resources. The document also distinguishes algorithms that may be disallowed in federal systems after certain dates from those that may remain permitted at users’ own risk.
Federal Systems Face Earlier Deadlines
The guidance turns the broad goal of preparing for quantum-era threats into a migration planning framework. Federal agencies have dates to work toward, and organizations that supply or support federal systems may also need to adapt their products and services to meet those requirements.
The staggered dates mean organizations cannot treat every cryptographic use case identically. Earlier action on key establishment for especially sensitive or long-lived data may reduce exposure to future decryption, while broader replacement work can take longer because cryptography is embedded in applications, infrastructure and supplier products. NIST’s report provides a shared reference for planning that work, but it does not remove the need for organization-specific inventories and risk decisions.
Popular right now
LG C2 Series 65-Inch OLED evo 4K Smart TV (OLED65C2PUA, 2022)
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
De'Longhi Linea Classic Espresso Machine with Adjustable Milk Frother
As an affiliate, we earn on qualifying purchases.
From 2024 Standards to Migration
NIST released its first post-quantum cryptography standards in August 2024. NISTIR 8547 follows that standards work by addressing how organizations can transition from older algorithms to the new standards, rather than setting out a single implementation schedule for every system.
The report supports federal timelines established through National Security Memorandum 10 and accelerated by Executive Order 14412, according to the source material. The 2035 target applies broadly to migration across federal systems; the earlier 2030 and 2031 targets apply to specified functions in high-value assets and high-impact systems. The report also complements a separate migration project at NIST’s National Cybersecurity Center of Excellence, which is developing demonstrations and practical resources.
“We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing.”
— Dustin Moody, NIST mathematician and head of the post-quantum cryptography standardization project
Implementation Will Vary by Organization
The report sets out broad federal targets, but the source material does not specify a single migration sequence or technical solution for every organization. The effort will depend on each organization’s systems, cryptographic supply chain and data risks. It is also not clear from the available information how individual vendors or agencies will schedule specific product changes.
The quantum computers capable of breaking the vulnerable cryptography described in the report are still in development. The timing of such a machine is not established here. NIST’s planning rationale includes the possibility that data collected today could be decrypted later, but the report does not claim that such decryption is currently possible.
Agencies and Partners Begin Planning
Federal agencies and affected partners can use NISTIR 8547 to review cryptographic inventories, identify dependencies and set priorities against the applicable deadlines. NIST’s National Cybersecurity Center of Excellence will continue its cross-sector project on migration, including demonstrations related to cryptographic visibility, risk management and post-quantum implementations.
The next practical developments are expected to come from organizations translating the road map into system-level plans and from the NCCoE project’s implementation resources. The report does not provide a single completion date for every organization outside the federal targets.
Key Questions
What is NISTIR 8547?
It is NIST’s report, Transition to Post-Quantum Cryptography Standards, outlining how organizations can move away from quantum-vulnerable cryptographic algorithms and adopt NIST’s post-quantum standards.
What deadlines does the report support?
Federal migration targets include 2035 for most systems, plus earlier deadlines of 2030 for key establishment and 2031 for digital signatures in high-value assets and high-impact systems.
Why begin migrating before a powerful quantum computer exists?
NIST cites the “harvest now, decrypt later” risk: sensitive encrypted data collected today could be targeted for decryption in the future if quantum technology becomes capable enough.
Does NIST require organizations to use hybrid cryptography?
No. The report discusses hybrid approaches that combine conventional and post-quantum cryptography as an option. NIST notes that this approach can be more conservative from a security standpoint but may require more computing resources.
Source: thequantuminsider.com
