NIST finaliza o NISTIR 8547 para migração a criptografia pós-quântica sob o prazo da Executive Order 14412 (2030/2031)
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:09; os links antigos trazem para cá.
NIST published guidance to help US federal agencies and their suppliers meet the post-quantum cryptography (PQC) transition deadlines in Executive Order 14412, issued in June 2026 (infosecurity-magazine.com). The document is the finalized NISTIR 8547, Transition to Post-Quantum Cryptography Standards, released on October 27, 2026 (gbhackers.com). It maps quantum-vulnerable cryptographic standards to their quantum-resistant replacements and builds on the PQC algorithms standardized in 2024, shifting the focus from algorithm selection to coordinated deployment across products, services and supply chains. The order requires "high value assets" and "high impact systems" to use PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031 (infosecurity-magazine.com). The wider federal horizon is National Security Memorandum 10, which sets 2035 overall (gbhackers.com). The central threat model is "harvest-now-decrypt-later", and cryptographically relevant quantum computers (CRQCs) could arrive within about five years (infosecurity-magazine.com). There is no active exploitation; this is strategic, long-horizon risk guidance (gbhackers.com). NIST says the deadlines leave little margin and demand immediate, sustained action from agencies, technology providers, standards bodies and infrastructure operators (infosecurity-magazine.com).
Detalhes técnicos
- FIPS 203 defines the post-quantum key-establishment mechanism prioritized for data that needs long-term confidentiality (gbhackers.com, infosecurity-magazine.com).
- Highly sensitive data, or data that must stay secure for a long time, should be migrated first because of harvest-now-decrypt-later attacks (infosecurity-magazine.com).
- Key establishment and digital signature migration have distinct dependencies. Authentication migration requires validating certificate chains, validation workflows and interoperability, not just swapping algorithms (gbhackers.com).
- Hybrid schemes that combine conventional encryption with PQC are accommodated for particularly sensitive systems. They give two layers of protection but raise computational cost, so performance and integration testing is needed (infosecurity-magazine.com, gbhackers.com).
- The guidance sets out how long less critical systems can keep using conventional encryption and how some algorithms will be phased out. Some will be disallowed in federal systems after a given date, and others allowed only at the user's own risk. NIST mathematician Dustin Moody stresses use-case-specific strategies (infosecurity-magazine.com, gbhackers.com).
- The approach is risk-based and urges agencies to examine their whole cryptographic supply chain (infosecurity-magazine.com).
Remediação
- Start the PQC transition now. Prioritize long-lived sensitive data and high value assets, with post-quantum key management first and digital signatures next (infosecurity-magazine.com, gbhackers.com).
- Build a cryptographic inventory using discovery tooling across source code, configuration files and certificates (gbhackers.com).
- Plan the migration around the algorithm phase-out and disallowance dates in the NIST guidance, and align with the 2030/2031/2035 federal timelines where applicable (infosecurity-magazine.com, gbhackers.com).
- Assess vendors and the full cryptographic supply chain, not only internal components (infosecurity-magazine.com, gbhackers.com).
- Consider hybrid classical and PQC deployments for the most sensitive systems, accounting for the extra compute cost (infosecurity-magazine.com).
- Use NIST NCCoE demonstrations on cryptographic visibility, agility and risk management (gbhackers.com).
Linha do tempo
-
NIST finalizes NISTIR 8547 guidance for migrating to post-quantum cryptography
ler a análise desta fonte ocultar
NIST published the finalized NISTIR 8547, Transition to Post-Quantum Cryptography Standards, on October 27, 2026, providing a migration framework that maps quantum-vulnerable cryptographic standards to their quantum-resistant replacements. The guidance builds on the post-quantum algorithms standardized in August 2024 and shifts focus from algorithm selection to coordinated deployment across products, services and supply chains. The central threat model is "harvest-now-decrypt-later", where adversaries collect encrypted traffic today for decryption once cryptographically relevant quantum computers exist. Federal deadlines come from National Security Memorandum 10 (2035 overall) and Executive Order 14412, which requires key establishment migration by 2030 and digital signatures by 2031 for high-value and high-impact federal systems. There is no active exploitation; this is strategic, long-horizon risk guidance.
Technical Details
- FIPS 203 defines the post-quantum key-establishment mechanism prioritized for data requiring long-term confidentiality.
- Key establishment and digital signature migration have distinct dependencies; authentication migration requires validating certificate chains, validation workflows and interoperability, not just algorithm swaps.
- Hybrid schemes combining classical and post-quantum cryptography are accommodated but raise computational cost, requiring performance and integration testing.
- NIST mathematician Dustin Moody stresses use-case-specific strategies and awareness of when legacy algorithms become disallowed or only usable with acknowledged risk.
Remediation
- Build a cryptographic inventory using discovery tooling across source code, configuration files and certificates.
- Prioritize post-quantum key management for long-lived sensitive data, then digital signatures.
- Assess vendors and the cryptographic supply chain; align with the 2030/2031/2035 federal timelines where applicable.
- Leverage NIST NCCoE demonstrations on cryptographic visibility, agility and risk management.
-
NIST publishes guidance to help US federal agencies meet post-quantum cryptography deadlines under Executive Order 14412
ler a análise desta fonte ocultar
The US NIST has published guidance to help federal agencies and their suppliers meet the post-quantum cryptography (PQC) transition deadlines set by Executive Order 14412, issued in June 2026. The order requires "high value assets" and "high impact systems" to use PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. NIST says the deadlines leave little margin and will require immediate, sustained action from agencies and from the technology providers, standards bodies and infrastructure operators they depend on. The guidance takes a risk-based approach and urges agencies to look at their whole cryptographic supply chain. It follows similar government deadlines and vendor pledges, and warnings that cryptographically relevant quantum computers (CRQCs) could arrive within about five years.
Technical Details
- The guidance references the PQC algorithm standards NIST published in 2024, including FIPS 203 for key establishment.
- Data that is highly sensitive or must stay secure for a long time should be migrated first, because of "harvest now, decrypt later" attacks.
- A hybrid option combines conventional encryption with PQC for particularly sensitive systems. It gives two layers of protection but needs more computational resources.
- The document also sets out how long less critical systems can keep using conventional encryption, and how some algorithms will be phased out. Some will be disallowed in federal systems after a given date, and others allowed only at the user's own risk (NIST mathematician Dustin Moody).
Remediation
- Start the PQC transition now and prioritize long-lived, sensitive data and high value assets.
- Plan the migration around the algorithm phase-out and disallowance dates in the NIST guidance.
- Assess the full cryptographic supply chain, not only internal system components.
- Consider hybrid classical and PQC deployments for the most sensitive systems, accounting for the extra compute cost.