HY Chang

NIST has published the final version of IR 8547, its plan for retiring quantum-vulnerable public-key cryptography. RSA and elliptic-curve algorithms at every approved key size are now deprecated after 2030 and disallowed after 2035. What changed from the 2024 draft: - P-256, RSA-3072 and Ed25519 had no deprecation step. Now they're deprecated from January 1, 2031, like RSA-2048, and disallowed after 2035. - A deprecated algorithm can still be used, but its owner has to examine the risk and decide. I expect auditors to ask for that decision system by system. - A hybrid with at least one approved input, such as ML-KEM, can be FIPS 140-validated even after its classical half is disallowed. - HQC is the alternative KEM and ML-KEM-768 the default parameter set. NIST says it will monitor developments and adjust its transition efforts as appropriate. What NIST left open: - Key exchange and signatures get the same dates. NIST itself says harvest now, decrypt later makes key exchange more urgent. - In Section 3.1.2, NIST still lets authentication systems wait for a CRQC. Under Table 2, the same algorithms are disallowed after 2035 regardless. - Contracts, registries and archives whose signatures must stay verifiable for decades get no guidance. My full analysis: postquantum.com/security-pqc… I cover the US requirements behind these dates in PQC Compliance: United States, a course I teach at Quantum Academy: quantumacademy.com/courses/p… #PQC #PostQuantum #NIST #Cryptography #Cybersecurity #CISO #PKI #TLS