EN PT-BR
← Voltar ao feed
low government

NIST finalizes 'Transition to Post-Quantum Cryptography Standards' report, setting 2030 deadlines for high-value federal systems

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 10:10 · coletado há 1 hora

NIST published the finalized report 'Transition to Post-Quantum Cryptography Standards'. It lists the quantum-vulnerable cryptographic standards, the quantum-resistant replacements, and the migration timelines and activities for federal agencies. The report stresses the 'harvest now, decrypt later' threat, in which adversaries collect encrypted data today to decrypt it once a cryptanalytically relevant quantum computer exists. NSM-10 keeps 2035 as the target for completing the federal migration. Executive Order 14412 and OMB Memorandum M-26-15 require high-value assets and high-impact systems to adopt PQC for key establishment by Dec. 31, 2030 and for digital signatures by Dec. 31, 2031. Quantum-vulnerable public-key cryptography will be deprecated after 2030 and disallowed after 2035.

Detalhes técnicos

  • Organizations may prioritize migrating to the PQC key establishment standard (FIPS 203) for data that is highly sensitive or must stay confidential for a long time.
  • Hybrid approaches combine conventional and PQC algorithms for key establishment or signatures. They hedge against a flaw in one algorithm but add complexity, cost and implementation risk. They are expected to be temporary. NIST will accommodate hybrid key-establishment modes and dual signatures in FIPS 140 validation when combined with a NIST-approved scheme.
  • Quantum-vulnerable and quantum-resistant algorithms will run side by side for interoperability, for example in protocol negotiation and in PKIs. Such coexistence is not considered hybrid when each session uses a single algorithm.
  • Applications, protocols, software cryptographic libraries, hardware cryptographic modules and infrastructure such as PKIs all need updating. The whole cryptographic supply chain matters.
  • Past cryptographic migrations took over a decade, and this one is expected to take at least as long.
  • NIST is revising CMVP processes to speed up validation of PQC modules, as directed by EO 14412.
  • Under EO 14306 and M-26-15, agencies must support TLS 1.3 by Jan. 2, 2030.

Remediação

  • Inventory cryptographic use and dependencies, including the cryptographic supply chain.
  • Prioritize systems and data with long-term confidentiality needs.
  • Identify systems that cannot support PQC and plan their replacement or decommissioning.
  • Build cryptographic agility into infrastructure.
  • Use the NCCoE Migration to PQC project resources for practical guidance.

Linha do tempo

  1. industrialcyber.co ↗ · pub. 02/11/2026 10:10 · coletado 02/11 12:01 primeiro registro

    NIST finalizes 'Transition to Post-Quantum Cryptography Standards' report, setting 2030 deadlines for high-value federal systems

    ler a análise desta fonte

    NIST published the finalized report 'Transition to Post-Quantum Cryptography Standards'. It lists the quantum-vulnerable cryptographic standards, the quantum-resistant replacements, and the migration timelines and activities for federal agencies. The report stresses the 'harvest now, decrypt later' threat, in which adversaries collect encrypted data today to decrypt it once a cryptanalytically relevant quantum computer exists. NSM-10 keeps 2035 as the target for completing the federal migration. Executive Order 14412 and OMB Memorandum M-26-15 require high-value assets and high-impact systems to adopt PQC for key establishment by Dec. 31, 2030 and for digital signatures by Dec. 31, 2031. Quantum-vulnerable public-key cryptography will be deprecated after 2030 and disallowed after 2035.

    Technical Details

    • Organizations may prioritize migrating to the PQC key establishment standard (FIPS 203) for data that is highly sensitive or must stay confidential for a long time.
    • Hybrid approaches combine conventional and PQC algorithms for key establishment or signatures. They hedge against a flaw in one algorithm but add complexity, cost and implementation risk. They are expected to be temporary. NIST will accommodate hybrid key-establishment modes and dual signatures in FIPS 140 validation when combined with a NIST-approved scheme.
    • Quantum-vulnerable and quantum-resistant algorithms will run side by side for interoperability, for example in protocol negotiation and in PKIs. Such coexistence is not considered hybrid when each session uses a single algorithm.
    • Applications, protocols, software cryptographic libraries, hardware cryptographic modules and infrastructure such as PKIs all need updating. The whole cryptographic supply chain matters.
    • Past cryptographic migrations took over a decade, and this one is expected to take at least as long.
    • NIST is revising CMVP processes to speed up validation of PQC modules, as directed by EO 14412.
    • Under EO 14306 and M-26-15, agencies must support TLS 1.3 by Jan. 2, 2030.

    Remediation

    • Inventory cryptographic use and dependencies, including the cryptographic supply chain.
    • Prioritize systems and data with long-term confidentiality needs.
    • Identify systems that cannot support PQC and plan their replacement or decommissioning.
    • Build cryptographic agility into infrastructure.
    • Use the NCCoE Migration to PQC project resources for practical guidance.