NIST Announces Plan to Phase Out Quantum-Vulnerable Encryption

NIST initiates process to phase out encryption susceptible to quantum attacks

NIST’s Strategic Plan for Post-Quantum Cryptography

The National Institute of Standards and Technology (NIST) has published a strategic plan outlining the transition to post-quantum cryptography (PQC), with accelerated timelines for critical federal infrastructure. The document, titled Transition to Post-Quantum Cryptography Standards (NIST IR 8547), details the cryptographic algorithms requiring replacement, considerations for implementation, and the structured approach to adoption. This framework expands upon PQC standards issued by NIST in August 2024, which introduced methodologies to safeguard data against threats posed by emerging quantum computing capabilities. While federal mandates do not universally apply to private enterprises, the roadmap holds significance for technology vendors and entities collaborating with government bodies.

Preparation Imperative for Cryptographic Resilience

Cryptography underpins data confidentiality and authenticity across digital interactions, including web access, business communications, and software updates. Quantum computers, once sufficiently advanced, could compromise existing encryption techniques. Although such systems remain in development, delaying action would leave current data vulnerable to exploitation. Adversaries may intercept and store encrypted information, awaiting quantum breakthroughs to decrypt it—a tactic termed “harvest now, decrypt later.” This necessitates proactive measures for organizations managing long-term sensitive data, such as medical records or classified government materials.

Comprehensive Migration Challenges

Adopting PQC entails more than software updates. Organizations rely on cryptographic libraries, hardware modules, digital certificates, and communication protocols requiring compatibility with new standards. Vendor support timelines and system interoperability will influence upgrade feasibility. NIST highlights that prior cryptographic transitions have spanned 10 to 20 years, urging entities to audit cryptographic usage, strategize modifications, and deploy PQC-compatible solutions. High-risk systems demanding long-term confidentiality should prioritize migration, while lower-risk applications may follow later.

Accelerated Deadlines for Federal Infrastructure

National Security Memorandum 10 sets 2035 as the target for federal PQC adoption. Executive Order 14412 and OMB Memorandum M-26-15 mandate federal high-value assets and critical systems to implement quantum-resistant key-establishment protocols by December 31, 2030. These methods secure shared secret keys for data protection. Quantum-resistant digital signatures, essential for verifying message integrity, must be adopted by December 31, 2031. Additionally, Executive Order 14306 and OMB Memorandum M-26-15 require federal agencies to support TLS version 1.3—a protocol securing network communications—by January 2, 2030.

Phasing Out Vulnerable Cryptographic Methods

NIST will discontinue support for quantum-vulnerable public-key cryptography after 2030, prohibiting its use in federal systems by 2035. Deprecation allows continued use but mandates risk assessments, while disallowance enforces strict prohibitions. “Organizations must understand how current algorithms will be retired, including timelines for prohibition or conditional use,” stated NIST mathematician Dustin Moody, leading the PQC standardization initiative. Systems unable to adopt PQC must be identified for replacement or decommissioning. NIST will collaborate with industry stakeholders and develop practical tools through its National Cybersecurity Center of Excellence to facilitate implementation.

“Organizations must understand how current algorithms will be retired, including timelines for prohibition or conditional use,” stated NIST mathematician Dustin Moody, leading the PQC standardization initiative.