Source: Help Net Security
Author: Anamarija Pogorelec
URL: https://www.helpnetsecurity.com/2026/10/28/nist-post-quantum-cryptography-migration-roadmap/
ONE SENTENCE SUMMARY:
NIST’s PQC roadmap details why, what, and when to replace quantum-vulnerable cryptography, setting phased federal deadlines through 2035.
MAIN POINTS:
- NIST IR 8547 provides guidance for transitioning systems to post-quantum cryptography standards.
- August 2024 PQC standards introduce quantum-resistant methods to protect future confidentiality and authenticity.
- Quantum computers threaten widely used public-key cryptography underpinning web, messaging, and software updates.
- “Harvest now, decrypt later” makes today’s encrypted data vulnerable to future decryption.
- Long-lived sensitive data like medical records and government secrets requires earlier migration planning.
- Migration affects libraries, hardware security modules, certificates, and protocols—not simple configuration changes.
- Vendor readiness and cross-system compatibility can significantly constrain upgrade timelines and sequencing.
- Prior cryptographic transitions took 10–20 years, motivating immediate crypto-inventory and deployment efforts.
- Sensitive federal systems must adopt PQ key establishment by 2030 and signatures by 2031.
- NIST will deprecate vulnerable algorithms after 2030 and disallow them after 2035.
TAKEAWAYS:
- Begin now by locating every cryptographic dependency across applications, infrastructure, and third-party services.
- Prioritize migrations where confidentiality must persist for many years against future quantum decryption.
- Plan multi-year modernization, including vendor coordination, certificate lifecycles, and protocol interoperability testing.
- Treat 2030–2031 as key milestones for federal-aligned environments, plus TLS 1.3 by 2030.
- Replace or retire systems unable to support PQC before deprecation and disallowance deadlines arrive.