Security

NIST finalizes IR 8547 report on transition to post-quantum cryptography standards

NIST has finalized NIST IR 8547, "Transition to Post-Quantum Cryptography Standards," which identifies the algorithms being phased out, their replacements, and infrastructure migration considerations. It builds on the agency's first three PQC standards, released in August 2024. The report supports requirements in Executive Order 14412 and OMB Memorandum M-26-15, under which federal high-value assets, high-impact systems, and other prioritized sensitive systems must adopt PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031; the overall federal goal remains 2035. NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow it under its standards and guidelines after 2035, and the report is a planning framework for industry rather than a universal business deadline.

Why it mattersSuppliers of network equipment, security hardware, and software must upgrade products used by federal agencies, and the report notes that dependencies such as TLS, SSH, IPsec, cryptographic libraries, hardware security modules, and public key infrastructure may need updating before applications can migrate. The report also points to the risk that adversaries collect encrypted traffic today to decrypt later, which makes key-establishment upgrades an immediate concern for data that must stay confidential for years.

Read the full story at SDxCentral →

Summarized by AI from the linked article.