NIST IR 8547 Final: What Changed From the Draft

27 Oct 2026 – The U.S. National Institute of Standards and Technology (NIST) published the final version of NIST Internal Report (IR) 8547, Transition to Post-Quantum Cryptography Standards, its plan for retiring quantum-vulnerable public-key algorithms, on October 27, 2026. The initial public draft of November 12, 2024, was withdrawn the same day.

NIST kept the draft’s two dates for quantum-vulnerable public-key cryptography, deprecation after 2030 and disallowance after 2035. In the draft, only 112-bit parameter sets such as RSA-2048 and the P-224 curve were to be deprecated after 2030. P-256, RSA-3072, Ed25519 and other parameters at 128 bits or more were to stay acceptable until their disallowance after 2035.

In the final report, NIST deprecates these algorithms at every approved strength after 2030: RSA and ECDSA signatures at 112 bits or more, EdDSA at 128 bits or more, and Diffie-Hellman, MQV and RSA key establishment at 112 bits or more. All of them are disallowed under NIST standards and guidelines after 2035. Under NIST’s definition, a deprecated algorithm may still be used, but the data owner must examine the security risk and decide whether to continue.

NIST aligned the final report with Executive Order (EO) 14412, signed on June 22, 2026, and with Memorandum M-26-15, which the White House Office of Management and Budget (OMB) issued on June 24. Under those directives, federal agencies must move high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030, and to post-quantum digital signatures by December 31, 2031. Agencies must give the same priority to other systems that hold highly sensitive data or are particularly exposed to quantum attack, including systems protecting data expected to remain mission-sensitive in 2030.