TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
NIST has published NISTIR 8547, a road map for replacing cryptographic algorithms that could be vulnerable to future quantum computers with post-quantum standards. It supports federal migration targets of 2035 for most systems, with earlier 2030 and 2031 deadlines for specified high-value and high-impact systems.
The National Institute of Standards and Technology has released a road map for moving from cryptographic algorithms vulnerable to future quantum computers to post-quantum cryptography standards. The report, NISTIR 8547, supports federal migration targets of 2035 for most systems, with earlier deadlines for key establishment and digital signatures in certain high-value and high-impact systems.
NISTIR 8547 describes quantum-vulnerable algorithms in existing NIST cryptographic standards and sets out how they are to be phased out in favor of post-quantum algorithms standardized by the agency in 2024. NIST says the document is intended to inform federal agencies, industry partners and standards organizations. It gives a high-level approach rather than a single implementation plan for every organization, whose systems and dependencies differ.
The federal timeline identifies 2035 as the primary target for completing migration across federal systems. The source report says Executive Order 14412 sets earlier dates for high-value assets and high-impact systems: 2030 for key establishment and 2031 for digital signatures. NISTIR 8547 supports those targets. The cited federal requirements apply to federal systems; organizations working with the government may also be affected, but the material does not specify obligations for every contractor or supplier.
The guidance calls on organizations to inventory their cryptographic systems and consider their entire supply chain, not just software and equipment they directly operate. It recommends prioritizing data that is especially sensitive or must remain confidential for a long time, in light of the possibility that data intercepted today could be decrypted later. NIST also discusses hybrid approaches that combine conventional cryptography with post-quantum methods, while noting that these can require more computing resources.
Deadlines Shape Migration Planning
The report turns the shift to post-quantum cryptography into a planning and procurement issue for organizations that rely on standardized encryption and digital signatures. Updating cryptography can involve many systems, vendors and connected services; an organization may need to identify where vulnerable algorithms are used before it can set a realistic migration sequence.
The potential exposure is not limited to future communications. The report points to the “harvest now, decrypt later” risk: an adversary could collect encrypted information now and seek to decrypt it if a sufficiently capable quantum computer becomes available. That makes the confidentiality life of data relevant to migration priorities, even while such a computer remains under development.
For federal agencies, the dates provide a schedule against which migration work can be organized. For companies and other organizations, the report is guidance on the transition, but the source material does not establish that every nonfederal organization is subject to the same deadlines. The likely practical effect is earlier review of cryptographic inventories, vendor plans and systems that protect long-lived sensitive information.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
DJI Osmo Mobile 8 3-Axis Smartphone Gimbal Stabilizer
Sonos Era 100 Wireless Smart Speaker, Black
As an affiliate, we earn on qualifying purchases.
From 2024 Standards to Migration
In August 2024, NIST released its first post-quantum cryptography standards, designed to resist attacks from a future sufficiently powerful quantum computer. NISTIR 8547 follows those standards with a high-level account of how existing quantum-vulnerable algorithms should be transitioned out of use. The report addresses the migration path, rather than announcing that quantum computers can currently break deployed encryption.
The federal schedule described by the source material was established through National Security Memorandum 10, which set 2035 as the principal migration target, and accelerated for certain systems by Executive Order 14412. NIST also has a National Cybersecurity Center of Excellence project focused on practical migration guidance. That cross-sector effort is working on demonstrations related to cryptographic visibility, risk management, cryptographic agility and implementation of the post-quantum standards.
“We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing.”
— Dustin Moody, NIST mathematician and head of the post-quantum cryptography standardization project
Implementation Details Still Vary
The report sets out a high-level transition approach, but the source material does not provide organization-specific migration schedules, costs or technical implementation details. The work required will depend on where vulnerable algorithms appear, how systems connect to suppliers and how long the data they protect must remain confidential.
It also remains unclear from the supplied information how each nonfederal organization will be affected by the federal targets. The material says government contractors may be affected, but does not define which contracts or systems carry particular requirements. Quantum computers capable of threatening current cryptography are still in development; the timing of such a capability is not established in the report summary.
Agencies and Vendors Map Systems
Federal agencies and organizations supporting them can use NISTIR 8547 to review cryptographic use, identify dependencies and plan against the applicable deadlines. The next practical steps include working with suppliers, prioritizing sensitive long-lived data and determining whether hybrid deployments are appropriate for particular systems.
NIST’s NCCoE migration project is expected to complement the report with demonstrations and practical tools for cryptographic visibility, risk management and implementation. The supplied material does not give a specific release date for those materials, so their timing and the pace of individual organizational migrations remain to be seen.
Key Questions
What is NISTIR 8547?
NISTIR 8547 is NIST’s high-level road map for transitioning from quantum-vulnerable cryptographic algorithms to the agency’s post-quantum standards.
What deadlines does the report support?
The federal target is 2035 for most systems. The source material gives earlier dates for high-value assets and high-impact systems: 2030 for key establishment and 2031 for digital signatures.
Does the report mean quantum computers can break encryption now?
No. The report addresses preparation for a future sufficiently powerful quantum computer. The source says such computers are still in development; it does not say current encryption has already been broken by them.
Why migrate before a powerful quantum computer exists?
One concern is “harvest now, decrypt later”, in which encrypted data is collected today for possible decryption in the future. Information that must remain confidential for many years may merit earlier attention.
Are the federal dates mandatory for every organization?
The supplied material describes these as federal migration targets. It says organizations working with the federal government may be affected, but does not specify requirements for every nonfederal organization.
Source: thequantuminsider.com
