The short answer: NIST IR 8547 is still an Initial Public Draft. It proposes that quantum-vulnerable public-key algorithms at the 112-bit security level, which includes RSA-2048, be deprecated after 2030, and that all quantum-vulnerable public-key algorithms be disallowed after 2035. Stronger classical parameters, such as ECDSA with P-256, have no 2030 stage at all: the draft lists them as disallowed after 2035. And “deprecated” in NIST’s vocabulary does not mean banned.
“RSA and ECC get deprecated by 2030, disallowed by 2035” is one of the most repeated lines in post-quantum content. It compresses three things that matter: the document is a draft, the 2030 date applies only to the weakest parameter sets, and deprecation is a defined status that still permits use. This post goes through what the draft actually says.
Where the claim comes from, and its status
The source is NIST Internal Report 8547, “Transition to Post-Quantum Cryptography Standards”, published as an Initial Public Draft on 12 November 2024. NIST describes it as setting out its expected approach to moving from quantum-vulnerable algorithms to post-quantum digital signature algorithms and key-establishment schemes. The public comment period closed on 10 January 2025, and NIST posted the comments it received on 21 January 2025.
As of 14 October 2026, NIST’s Computer Security Resource Center still lists IR 8547 as an Initial Public Draft. Its dates are a proposal. They are the clearest signal of where NIST intends to go, but they should be reported as proposed, not as settled policy.
What the draft proposes, algorithm by algorithm
The draft groups quantum-vulnerable algorithms by security strength. Two tables carry the dates: Table 2 for digital signatures and Table 4 for key establishment.
- Digital signatures (Table 2): ECDSA and RSA at 112 bits of security strength are “Deprecated after 2030” and “Disallowed after 2035”. ECDSA, EdDSA and RSA at 128 bits or more are “Disallowed after 2035”.
- Key establishment (Table 4): finite field Diffie-Hellman and MQV, elliptic curve Diffie-Hellman and MQV, and RSA key establishment at 112 bits are “Deprecated after 2030” and “Disallowed after 2035”. At 128 bits or more they are “Disallowed after 2035”.
To place real key sizes in those rows, NIST SP 800-57 Part 1 Revision 5 gives comparable security strengths: RSA with a 2048-bit modulus provides 112 bits, and RSA with a 3072-bit modulus provides 128 bits. Elliptic curve keys of 224 to 255 bits provide 112 bits, and keys of 256 to 383 bits provide 128 bits. So RSA-2048 falls in the 112-bit row and would be deprecated after 2030, while ECDSA on P-256 falls in the 128-bit row, with no deprecation stage and a single date: disallowed after 2035.
The draft explains the 112-bit choice. NIST’s earlier guidance in SP 800-57 Part 1 had projected that public-key schemes providing 112 bits of security would be disallowed on 1 January 2031. Because of the post-quantum migration happening in the same period, NIST “intends to instead deprecate” them, and the draft says organisations “may continue using these algorithms and parameter sets” as they migrate.
The replacements are the post-quantum standards NIST published on 13 August 2024: FIPS 203 (ML-KEM) for key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA, a stateless hash-based signature algorithm) for signatures, alongside the stateful hash-based schemes LMS and XMSS in SP 800-208. For key establishment, the draft notes that application-specific guidance “may require or recommend migration” earlier than the general dates, to mitigate “harvest now, decrypt later” attacks.
What “deprecated” means in NIST’s system
IR 8547 uses the approval-status terms defined in NIST SP 800-131A and quotes their definitions:
- Acceptable: the algorithm and key length or strength are approved for use in accordance with any associated guidance.
- Deprecated: the algorithm and key length or strength “may be used, but there is some security risk. The data owner must examine this risk potential and decide whether to continue to use a deprecated algorithm or key length.”
- Disallowed: the algorithm, key length or strength, parameter set or scheme “is no longer allowed for the stated purpose”.
- Legacy use: the algorithm, scheme or parameter set may only be used to process already protected information, for example to decrypt ciphertext or to verify a digital signature.
Deprecation therefore moves a decision onto the data owner: continued use is permitted, but it is a risk someone has to examine and accept. Disallowance is the hard stop.
NIST has run transitions in these terms before. SP 800-131A Revision 1, published in November 2015, listed two-key Triple DES encryption as “Restricted through 2015” and “Disallowed after 2015”, with two-key Triple DES decryption moved to “Legacy-use”. The same revision listed non-compliant Diffie-Hellman and MQV schemes at 112 bits or more as “Deprecated through 2017” and “Disallowed after 2017”. Each change came with a published date and a defined status, which is the shape IR 8547 proposes for 2030 and 2035.
How IR 8547 relates to the US federal deadlines
Separate, binding dates now sit close to the draft’s horizon. Executive Order 14412, signed on 22 June 2026, requires OMB guidance directing agencies to transition all high value assets and high impact systems, excluding National Security Systems, to post-quantum key establishment by 31 December 2030 and to post-quantum digital signatures by 31 December 2031. OMB Memorandum M-26-15, issued on 24 June 2026, gives each agency 120 days to submit a PQC Migration Plan, which falls on 22 October 2026.
These are different instruments with different scopes. The executive order’s dates apply to a defined set of federal systems. IR 8547’s proposed dates are about the approval status of algorithms in NIST standards. They point in the same direction, which is why the draft is treated as a planning signal even before it is final, but one should not be reported as the other.
What to do before any status changes
The practical work does not depend on whether the final dates match the draft. Because the draft splits its dates by security strength, the first useful question is not “do we use RSA?” but “which algorithm, at which key size, protecting what?” RSA-2048 and RSA-3072 sit in different rows. So do 224-bit and 256-bit elliptic curve keys.
- Record key sizes, not just algorithm names. An inventory that says “RSA” cannot tell you which systems the 2030 row would reach.
- Separate key establishment from signatures. The draft gives them separate tables, and key establishment carries the added “harvest now, decrypt later” pressure.
- Document risk decisions now. If deprecation arrives as proposed, continued use of a 112-bit algorithm becomes a decision a data owner has to make and stand behind.
- Watch for the final version. Check the CSRC page for IR 8547 before relying on any date in it.
Within the Enterprise Cryptographic Exposure Management (ECEM) lifecycle – Discover, Inventory, Assess, Prioritise, Transition, Monitor – this is the Inventory and Assess work: a living Cryptography Bill of Materials that records algorithm, key size and purpose for each use, so that when NIST finalises its dates, the affected systems are a query rather than a new discovery project.
Frequently asked questions
Is NIST IR 8547 final?
No. NIST IR 8547 was published as an Initial Public Draft on 12 November 2024, and its comment period closed on 10 January 2025. As of 14 October 2026, NIST’s Computer Security Resource Center still lists it as an Initial Public Draft, so its 2030 and 2035 dates are proposals.
Is RSA-2048 deprecated after 2030?
Under the draft, yes. RSA-2048 provides 112 bits of security strength, and IR 8547 proposes that RSA at 112 bits be deprecated after 2030 and disallowed after 2035, for both digital signatures and key establishment. Deprecated means it may still be used, with the data owner examining and accepting the risk.
Is ECDSA P-256 deprecated after 2030?
No. P-256 provides 128 bits of security strength, and the draft lists ECDSA at 128 bits or more as disallowed after 2035, with no deprecation stage in 2030. The same applies to EdDSA and to RSA at 128 bits or more, such as RSA-3072.
What does deprecated mean in NIST terms?
In NIST SP 800-131A, which IR 8547 quotes, deprecated means the algorithm and key length may be used, but there is some security risk, and the data owner must examine that risk and decide whether to continue using it. Disallowed means it is no longer allowed for the stated purpose.
Is IR 8547 the same as the US executive order deadlines?
No. Executive Order 14412 separately requires federal agencies to move high value assets and high impact systems, excluding National Security Systems, to post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. IR 8547 proposes approval-status changes for algorithms in NIST standards.
Sources: NIST, IR 8547 (Initial Public Draft), Transition to Post-Quantum Cryptography Standards, 12 November 2024, and the full text; NIST, SP 800-57 Part 1 Revision 5, Table 2; NIST, SP 800-131A Revision 1 (November 2015); NIST, FIPS 203; The White House, Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (22 June 2026); OMB, M-26-15, Execution of the Migration to Post-Quantum Cryptography (24 June 2026).
Further reading: what OMB M-26-15 and EO 14412 mean for suppliers, when quantum computers could break RSA-2048, NIST’s post-quantum standards explained and building an Enterprise CBOM.