The calendar invite has arrived
RSA did not fail this week. It was given an end date.
The current story is NIST Internal Report 8547, the final transition roadmap that sets out how U.S. federal systems are expected to move away from quantum-vulnerable public-key cryptography. Recent analyses of the final report agree on the key point: RSA, ECDSA, EdDSA, Diffie-Hellman and elliptic-curve key-establishment schemes are now on a federal retirement track, deprecated after 2030 and disallowed under NIST standards after 2035 . In practical terms, NIST has moved the quantum transition from “prepare someday” to “inventory now, migrate in phases, finish before the ban.”
The dates matter because RSA and elliptic-curve cryptography are not niche technologies. They underpin TLS handshakes, certificate chains, software signing, identity federation, VPNs, APIs, update systems, code-signing pipelines and embedded-device trust. FreeQuantumComputing’s November 2 summary describes the final roadmap as mapping vulnerable key-establishment systems to ML-KEM under FIPS 203, digital signatures to ML-DSA under FIPS 204, and conservative signature use cases to SLH-DSA under FIPS 205 . That is the architectural shift: the old public-key primitives are being mapped to post-quantum replacements rather than merely strengthened with bigger classical keys.
Why 2030 is now the real operational deadline
The headline date is 2035, but the operational shock starts earlier. TechBag’s current analysis notes that the final report deprecates every quantum-vulnerable public-key algorithm after 2030, whereas the 2024 draft had treated the weakest 112-bit tier more narrowly . SITG-Consulting reaches the same conclusion: organizations that planned only around the draft’s 112-bit boundary now face a wider 2030 deprecation line covering all quantum-vulnerable public-key cryptography at every security strength .
That distinction is important. “Deprecated” does not mean “instantly illegal,” but it does mean the algorithm carries recognized security risk and requires risk acceptance. “Disallowed” is the harder stop: after 2035, the affected algorithms no longer qualify for protection under the relevant NIST standards . For federal agencies and suppliers, the period between 2031 and 2035 is therefore not a grace period for beginning the transition. It is the period for completing it.
The nearer milestones are also tighter for sensitive federal systems. FreeQuantumComputing reports that federal high-value assets and high-impact systems now face December 31, 2030 for key establishment and December 31, 2031 for digital signatures, while the broader federal migration still points to 2035 . SITG-Consulting similarly lists the end-2030 key-establishment deadline and the end-2031 digital-signature deadline for high-value and high-impact systems, excluding national security systems, and connects those dates to the 2026 executive and OMB migration framework .
The long runway is deceptive
Nine years sounds generous until the dependency map appears. Cryptography is not a single library swap. It lives in load balancers, hardware security modules, smart cards, firmware signing flows, mobile apps, root and intermediate certificate authorities, build systems, CI/CD signing services, TLS inspection devices, SAML and OIDC integrations, VPN concentrators and devices that may never receive a major update.
That is why the first practical task is discovery, not algorithm selection. TechBag’s buyer-focused checklist begins with the same question every organization now needs to ask vendors: where exactly are RSA and elliptic-curve cryptography used, and can the supplier provide a cryptographic bill of materials listing algorithms, key sizes, protocols and libraries by component ? Without that inventory, a migration plan is guesswork.
SITG-Consulting frames this as a governance problem: agencies and affected organizations must show that they know what must be migrated, not merely that they support the idea of post-quantum cryptography . It also points out a timing problem: agency migration plans were due shortly before the final IR 8547 was published, so any plan built against the narrower draft scope may need to be reopened .
The threat is not only “harvest now, decrypt later”
The most familiar quantum-risk story is harvest-now-decrypt-later: adversaries record encrypted traffic now, then decrypt it when a cryptographically relevant quantum computer exists. SecureWorld’s November 3 analysis notes that this remains a top-tier risk for long-lived secrets such as state secrets, healthcare records and core intellectual property . That risk is already present because the collection can happen before the quantum computer arrives.
But the RSA and ECC deadline is broader than confidentiality. SecureWorld argues that the larger blind spot is digital trust: authentication, certificates, remote access, APIs, cloud authorization, electronic contracts and financial transactions all depend on public-key mechanisms that could be undermined if the underlying algorithms become forgeable . In other words, the post-quantum problem is not just “someone reads an old secret.” It is also “someone impersonates a trusted service,” “someone forges a software update,” or “someone challenges the integrity of a signed record.”
That is why signatures may be harder than key exchange. Browsers and major TLS stacks can introduce hybrid key exchange relatively quickly at the edge, but signatures require every relying party to verify new algorithms and every certificate, artifact and policy system to understand them. TechBag’s analysis makes the same point for buyers: key exchange can often move first, while signatures and certificates take longer because every verifier in the chain has to move together .
Vendors just inherited a procurement question
The final IR 8547 timeline is a federal document, but its pressure will flow into contracts. Agencies cannot migrate without cloud providers, software vendors, device manufacturers, certificate authorities, systems integrators and managed-service providers. The moment a buyer asks for evidence of post-quantum readiness, the deadline becomes a commercial requirement.
That pressure is already visible in how current commentary translates NIST’s roadmap into procurement language. TechBag recommends asking vendors for a cryptographic inventory first, then dated answers on key exchange, signatures, hardware and agility . FreeQuantumComputing similarly emphasizes that the roadmap points organizations toward early work on inventories, migration planning and post-quantum-enabled products rather than waiting for 2035 .
The hardest conversations will involve long-lived assets. A server bought in 2027 can be replaced before 2035. A medical device, industrial controller, satellite component, building-access system or field sensor may still be operating after the deadline. Certificates embedded at manufacture, firmware-signing keys, secure-boot chains and remote-update channels are exactly the places where late crypto changes become expensive or impossible.
What should happen next
For agencies and vendors, the immediate work is not to rip out RSA overnight. It is to create a defensible migration sequence.
First, build or refresh the cryptographic inventory: algorithms, key sizes, certificate paths, protocol versions, hardware modules, signing services, trust anchors and data-retention timelines. Second, classify systems by risk: long-lived confidential data, externally exposed services, high-value assets, high-impact systems and components that cannot be patched quickly. Third, test hybrid and post-quantum options where standards and interoperability are mature enough, especially for key establishment. Fourth, put PQC clauses into renewals and purchases so that products bought now do not become stranded assets in 2031 or 2035.
The main lesson of NIST’s deadline is that the quantum transition is no longer a research horizon. It is a program-management problem with dates, owners and dependencies. RSA and elliptic curves will not vanish from the internet in a single cutover. But for federal systems, and for vendors that sell into them, the countdown has started.
RSA just received its end-of-life calendar invite. The rest of the stack needs to RSVP.
Comments
Be the first to comment.