The U.S. National Institute of Standards and Technology (NIST) rolled out a finalized report to help organizations transition to the agency’s post-quantum cryptography standards, which are necessary to withstand attacks by future quantum computers. Titled ‘Transition to Post-Quantum Cryptography Standards,’ the report identifies existing quantum-vulnerable cryptographic standards and quantum-resistant standards designed to replace them. It also describes timelines and migration activities for federal agencies, and can serve as a key resource for technology providers and organizations developing their quantum-readiness road maps.
While quantum computers are still in development, a sufficiently powerful device, known as a cryptanalytically relevant quantum computer, would threaten encryption methods that protect confidential electronic information, from email messages to financial statements. Even though the transition to PQC is beginning before such a device appears, today’s encrypted data is already at risk from the ‘harvest now, decrypt later’ threat, where adversaries collect sensitive data now with the intention of decrypting it when quantum technology matures. This threat is one of the main reasons why the transition to PQC is urgent, driving the need to make changes on a well-considered schedule.
“The report describes different use cases and says why one migration might take longer than another,” Dustin Moody, NIST mathematician who heads the PQC standardization project, said in a media statement last week. “We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing.”
“We lay out how certain encryption algorithms people are using today will get phased out,” Moody said. “It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk. Factors like this can help an organization plan.”
“The new report can help you understand the standards and requirements of the migration,” he added, “while the NCCoE project can show you the practical tools and blueprints to get the job done.”
Because migration is a logistically complex undertaking, the report also helps delineate the numerous factors that organizations should consider to complete the process. Not only are an organization’s own system components important, but also its entire cryptographic supply chain.
Some actions may take priority over others, Moody said. For example, because of the ‘harvest now, decrypt later’ threat, organizations might prioritize migrating to the PQC key establishment standard (FIPS 203) for data that is particularly sensitive or needs to be kept secure for a long time.
The report discusses option of taking a hybrid approach, in which an organization hedges its bets by combining conventional encryption with PQC, akin to using two padlocks on a door instead of one. NIST accommodates this option, which has the advantage of being more conservative from a security standpoint but also demands more computational resources.
The transition will require adopting new PQC algorithms while carefully deprecating and eventually removing the quantum-vulnerable algorithms now widespread in technological infrastructures. Public-private engagement will be crucial, and the National Cybersecurity Center of Excellence (NCCoE) Migration to PQC project offers resources and practical guidelines to help organizations manage their cryptographic transition.
The report also continues NIST’s dialogue with industry, standards organizations, and relevant agencies to develop a clear roadmap and realistic timeline for the move to PQC. NIST aims to keep the transition smooth and coordinated, balancing the urgency of adopting PQC against the need to minimize disruption to critical systems, and will monitor developments closely and adjust its efforts as new technological or operational developments emerge. Ultimately, a smooth transition depends on building long-term cryptographic agility into organizational infrastructure so that updates can be made seamlessly as post-quantum standards evolve.
NIST identified that once PQC algorithms have been standardized, applications will need to be modified to make use of them. Many applications include components that are based on standardized protocols and security technologies that will need to be revised to support using PQC algorithms.
In addition, applications are built on top of software cryptographic libraries that either provide the implementations of the cryptographic algorithms or provide an interface to hardware cryptographic modules. Any software cryptographic libraries and hardware cryptographic modules used by an application will also need to be revised to support the PQC algorithms. Applications may also rely upon infrastructure components, such as public key infrastructures (PKIs), that would need to be updated to support the PQC algorithms before the applications themselves can migrate to using the PQC algorithms.
Even though there are no existing cryptanalytically relevant quantum computers that currently threaten levels of security, it will take a significant amount of time to transition to new postquantum algorithms. Past cryptographic migrations have taken over a decade, and this more complex migration will likely take at least that long. There will be an extended period during which both older quantum-vulnerable algorithms and their PQC replacements will coexist and be validated by NIST. As directed by Executive Order 14412 [EO14412], NIST is also revising Cryptographic Module Validation Program (CMVP) processes to accelerate the validation of cryptographic modules that implement PQC algorithms.
Migration to post-quantum cryptography may initially include hybrid solutions that combine quantum-resistant and quantum-vulnerable algorithms when establishing cryptographic keys or generating digital signatures. Hybrid solutions may also combine multiple PQC key-establishment or signature algorithms that rely on different mathematical assumptions. They are typically designed to stay secure as long as at least one component algorithm is secure, which makes them a hedge against a cryptographic or implementation flaw in one of the underlying algorithms. They can also provide a path for adopting PQC where sector-specific requirements still call for legacy quantum-vulnerable algorithms.
However, hybrid solutions add complexity to implementations and architectures, which can raise security risks and costs during the transition. They are generally expected to be temporary, leading to a second transition to tools that use only PQC algorithms.
Early implementations of new algorithms may also introduce risks such as implementation errors or side-channel vulnerabilities. These trade-offs will vary with the hybrid techniques used, the applications involved, and the vendor and user communities that develop and deploy them, so implementers and standards organizations must weigh the security, cost and complexity of hybrid approaches in their environments. Industry and standards bodies are considering a variety of hybrid techniques for key establishment and digital signatures, and NIST intends to accommodate them in its cryptographic standards where their use is desired.
Whether or not hybrid solutions are used, quantum-vulnerable and quantum-resistant algorithms will be fielded side by side in many applications and systems during the transition to ensure interoperability. For example, many network security protocols let two parties negotiate which algorithms to use in each session, and PKIs using quantum-vulnerable signature algorithms are expected to run alongside those using quantum-resistant ones.
Such approaches are not considered hybrid if each session uses only a single algorithm for key establishment and/or digital signatures. NIST leaves it to each application to decide whether it can afford the implementation cost, performance reduction and engineering complexity of a hybrid key-establishment mode or dual signatures, including proper and independent security reviews. To assist parties that want such a mechanism, NIST will accommodate hybrid key-establishment modes and dual signatures in FIPS 140 validation when they are combined with a NIST-approved scheme.
NIST’s cryptography standards cover a broad range of mechanisms that protect the confidentiality, integrity and authenticity of data, including encryption, digital signatures, hash functions, key establishment and random number generation. They also define key-management practices, guidance on protocols such as TLS, and requirements for cryptographic modules validated by the CMVP. NIST has now developed PQC standards to guard against future quantum attacks, and it continues to update its standards with industry, academia and other stakeholders as threats and technology evolve.
National Security Memorandum 10 set 2035 as the target for completing the federal migration to post-quantum cryptography, and that goal stands. Later directives require the government’s most sensitive systems to move much sooner. Executive Order 14412 established the policy framework for accelerating protection against quantum threats, and OMB Memorandum M-26-15 directs agencies to run a risk-prioritized migration that mitigates as much quantum risk as feasible by Dec. 31, 2030. High-value assets and high-impact systems, meaning those with at least one FIPS 199 security objective rated ‘high,’ must adopt PQC for key establishment by Dec.31, 2030 and for digital signatures by Dec. 31, 2031. Other highly sensitive or particularly vulnerable systems, including those protecting data expected to stay mission-sensitive in 2030, receive the same priority. Under Executive Order 14306 and M-26-15, agencies must also support TLS 1.3 by Jan. 2, 2030.
NIST’s transition schedule supports this risk-based approach of quantum-vulnerable public-key cryptography will be deprecated after 2030 and disallowed under NIST standards and guidelines after 2035. This 2030-2035 window accommodates lower-risk and legacy systems but does not change the earlier deadlines for high-sensitivity federal systems.
Systems that cannot support PQC should be identified and prioritized for replacement or decommissioning. Timelines will still vary by use case, with systems protecting data that has long-term confidentiality needs migrating first and lower-risk systems later in the period, while NIST works to support these varying timelines and keep the overall 2035 goal in place.
Commenting on the NIST move, Ali El Kaafarani, founder and CEO of PQShield, wrote in an emailed statement that NIST is leading by example and delivering clearer guidelines for the massive post-quantum transition ahead. “Alongside this summer’s Executive Order, this is a welcome intervention – more than anything, firm deadlines and transition plans from the federal government give the entire supply chain the pressure it needs to upgrade its cryptography against the quantum risk.”
He added that formal PQC standards have existed for two years now, but there is no one-size-fits-all way to implement them. This new report recognizes that by issuing clear and differentiated recommendations for protecting hardware, applications, email, documents and more.
“The next step is for industry-level regulators to follow suit,” according to Kaafarani. “The bodies that govern critical sectors like banking, automaking, telecoms, and energy now have the opportunity to match NIST’s commitments and make sure that digital and physical infrastructure isn’t left vulnerable after 2035.”
Last week, NIST outlined 10 design tenets for agent identity management systems, calling for distinct identities, tightly scoped permissions, continuous monitoring and stronger accountability as organizations expand their use of AI agents. The guidance covers identity, authentication and authorization across enterprise and consumer-facing applications, recommending cryptographically verifiable identities for agents, least-privilege access limited to specific tasks, short-lived and revocable authorization, and human review when actions exceed defined risk thresholds. The tenets are meant to help organizations manage the risks of agents acting on behalf of individuals and organizations.
