NIST says quantum-vulnerable public-key algorithms are deprecated after 2030 and disallowed after 2035
Short answer: On 27 October 2026 the US National Institute of Standards and Technology published NIST IR 8547, Transition to Post-Quantum Cryptography Standards. NIST says it will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035.
The report is dated October 2026. Its publication history says the NIST Editorial Review Board approved it on 21 October 2026, and both NIST's news post and the Computer Security Resource Center list 27 October 2026. It is the agency's plan for moving off public-key methods that a cryptanalytically relevant quantum computer could break, toward the post-quantum standards NIST finished in 2024: FIPS 203 (ML-KEM) for key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. Dustin Moody, the NIST mathematician who leads the project, said there is "not one strategy that fits all use cases".
For signatures, NIST's table covers ECDSA, EdDSA and RSA as specified in FIPS 186, at the parameter sets it still treats as approved: at least 112 bits of classical security for ECDSA and RSA, and at least 128 bits for EdDSA. Each is marked deprecated after 2030 and disallowed after 2035. The same window applies to quantum-vulnerable key establishment in Special Publications 800-56A and 800-56B: finite-field and elliptic-curve Diffie-Hellman and MQV, and RSA key establishment, again from 112 bits of classical security upward. NIST says this replaces an older plan, in SP 800-57 Part 1, to disallow public-key schemes offering 112 bits of security on 1 January 2031.
National Security Memorandum 10 still names 2035 as the target for finishing the migration across federal systems, the report says. Executive Order 14412 and OMB Memorandum M-26-15, as the report describes them, pull the most sensitive systems forward: high-value assets and high-impact systems are to adopt post-quantum key establishment by 31 December 2030 and post-quantum digital signatures by 31 December 2031. NIST says the broader 2030-2035 window does not relax those earlier deadlines. The report also says Executive Order 14306 and the same OMB memo require agencies to support TLS 1.3 no later than 2 January 2030.
NIST says ML-KEM, specified in FIPS 203, is at present the only approved post-quantum key-establishment scheme based on public-key cryptography, and it recommends the ML-KEM-768 parameter set as the default. HQC has been chosen for a future standard; NIST says it becomes an approved scheme after that standard is published. Symmetric cryptography is on a different footing: the report says approved symmetric primitives with at least 128 bits of classical security are believed to meet at least Category 1 on NIST's post-quantum scale, while a few symmetric standards at the 112-bit level are to be disallowed in 2030.