NIST finalizes NISTIR 8547 for post-quantum cryptography migration under Executive Order 14412 deadlines (2030/2031)

Linha do tempo

1. industrialcyber.co ↗ · pub. 02/11/2026 10:10 · coletado 02/11 12:01

   NIST finalizes 'Transition to Post-Quantum Cryptography Standards' report, setting 2030 deadlines for high-value federal systems

   ler a análise desta fonte ocultar

   NIST published the finalized report 'Transition to Post-Quantum Cryptography Standards'. It lists the quantum-vulnerable cryptographic standards, the quantum-resistant replacements, and the migration timelines and activities for federal agencies. The report stresses the 'harvest now, decrypt later' threat, in which adversaries collect encrypted data today to decrypt it once a cryptanalytically relevant quantum computer exists. NSM-10 keeps 2035 as the target for completing the federal migration. Executive Order 14412 and OMB Memorandum M-26-15 require high-value assets and high-impact systems to adopt PQC for key establishment by Dec. 31, 2030 and for digital signatures by Dec. 31, 2031. Quantum-vulnerable public-key cryptography will be deprecated after 2030 and disallowed after 2035.

   Technical Details

   • Organizations may prioritize migrating to the PQC key establishment standard (FIPS 203) for data that is highly sensitive or must stay confidential for a long time.
   • Hybrid approaches combine conventional and PQC algorithms for key establishment or signatures. They hedge against a flaw in one algorithm but add complexity, cost and implementation risk. They are expected to be temporary. NIST will accommodate hybrid key-establishment modes and dual signatures in FIPS 140 validation when combined with a NIST-approved scheme.
   • Quantum-vulnerable and quantum-resistant algorithms will run side by side for interoperability, for example in protocol negotiation and in PKIs. Such coexistence is not considered hybrid when each session uses a single algorithm.
   • Applications, protocols, software cryptographic libraries, hardware cryptographic modules and infrastructure such as PKIs all need updating. The whole cryptographic supply chain matters.
   • Past cryptographic migrations took over a decade, and this one is expected to take at least as long.
   • NIST is revising CMVP processes to speed up validation of PQC modules, as directed by EO 14412.
   • Under EO 14306 and M-26-15, agencies must support TLS 1.3 by Jan. 2, 2030.

   Remediation

   • Inventory cryptographic use and dependencies, including the cryptographic supply chain.
   • Prioritize systems and data with long-term confidentiality needs.
   • Identify systems that cannot support PQC and plan their replacement or decommissioning.
   • Build cryptographic agility into infrastructure.
   • Use the NCCoE Migration to PQC project resources for practical guidance.
2. gbhackers.com ↗ · pub. 29/10/2026 09:20 · coletado 29/10 11:01

   NIST finalizes NISTIR 8547 guidance for migrating to post-quantum cryptography

   ler a análise desta fonte ocultar

   NIST published the finalized NISTIR 8547, Transition to Post-Quantum Cryptography Standards, on October 27, 2026, providing a migration framework that maps quantum-vulnerable cryptographic standards to their quantum-resistant replacements. The guidance builds on the post-quantum algorithms standardized in August 2024 and shifts focus from algorithm selection to coordinated deployment across products, services and supply chains. The central threat model is "harvest-now-decrypt-later", where adversaries collect encrypted traffic today for decryption once cryptographically relevant quantum computers exist. Federal deadlines come from National Security Memorandum 10 (2035 overall) and Executive Order 14412, which requires key establishment migration by 2030 and digital signatures by 2031 for high-value and high-impact federal systems. There is no active exploitation; this is strategic, long-horizon risk guidance.

   Technical Details

   • FIPS 203 defines the post-quantum key-establishment mechanism prioritized for data requiring long-term confidentiality.
   • Key establishment and digital signature migration have distinct dependencies; authentication migration requires validating certificate chains, validation workflows and interoperability, not just algorithm swaps.
   • Hybrid schemes combining classical and post-quantum cryptography are accommodated but raise computational cost, requiring performance and integration testing.
   • NIST mathematician Dustin Moody stresses use-case-specific strategies and awareness of when legacy algorithms become disallowed or only usable with acknowledged risk.

   Remediation

   • Build a cryptographic inventory using discovery tooling across source code, configuration files and certificates.
   • Prioritize post-quantum key management for long-lived sensitive data, then digital signatures.
   • Assess vendors and the cryptographic supply chain; align with the 2030/2031/2035 federal timelines where applicable.
   • Leverage NIST NCCoE demonstrations on cryptographic visibility, agility and risk management.
3. infosecurity-magazine.com ↗ · pub. 29/10/2026 06:45 · coletado 29/10 08:01 primeiro registro

   NIST publishes guidance to help US federal agencies meet post-quantum cryptography deadlines under Executive Order 14412

   ler a análise desta fonte ocultar

   The US NIST has published guidance to help federal agencies and their suppliers meet the post-quantum cryptography (PQC) transition deadlines set by Executive Order 14412, issued in June 2026. The order requires "high value assets" and "high impact systems" to use PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. NIST says the deadlines leave little margin and will require immediate, sustained action from agencies and from the technology providers, standards bodies and infrastructure operators they depend on. The guidance takes a risk-based approach and urges agencies to look at their whole cryptographic supply chain. It follows similar government deadlines and vendor pledges, and warnings that cryptographically relevant quantum computers (CRQCs) could arrive within about five years.

   Technical Details

   • The guidance references the PQC algorithm standards NIST published in 2024, including FIPS 203 for key establishment.
   • Data that is highly sensitive or must stay secure for a long time should be migrated first, because of "harvest now, decrypt later" attacks.
   • A hybrid option combines conventional encryption with PQC for particularly sensitive systems. It gives two layers of protection but needs more computational resources.
   • The document also sets out how long less critical systems can keep using conventional encryption, and how some algorithms will be phased out. Some will be disallowed in federal systems after a given date, and others allowed only at the user's own risk (NIST mathematician Dustin Moody).

   Remediation

   • Start the PQC transition now and prioritize long-lived, sensitive data and high value assets.
   • Plan the migration around the algorithm phase-out and disallowance dates in the NIST guidance.
   • Assess the full cryptographic supply chain, not only internal system components.
   • Consider hybrid classical and PQC deployments for the most sensitive systems, accounting for the extra compute cost.