NIST starts the countdown to retire quantum-vulnerable encryption

The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive federal systems.

The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), explains which cryptographic methods need to be replaced, what organizations should consider and how the transition will unfold.

It builds on the post-quantum cryptography standards NIST released in August 2024. Those standards provide new ways to protect information against attacks by future quantum computers.

Although the federal requirements do not apply to all businesses, the roadmap matters to technology providers and organizations that work with government agencies.

“We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing,” said NIST mathematician Dustin Moody, who heads the PQC standardization project.

Why organizations need to prepare

Cryptography helps keep information private and verify that messages, software and online services are authentic. It supports activities such as accessing websites, exchanging business information and installing software updates.