Two documents now shape most post-quantum migration plans. NIST IR 8547 sets the transition timeline for US federal systems and, in practice, for the many organisations that follow NIST guidance. The NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) sets requirements for national security systems and their suppliers.
NIST IR 8547: transition to post-quantum standards
NIST's transition document, released as an initial public draft in November 2024, sets out the phase-out of quantum-vulnerable public-key algorithms (RSA, ECDSA, EdDSA, DH and ECDH):
| Milestone | Applies to | Status |
|---|---|---|
| After 2030 | Quantum-vulnerable algorithms at the 112-bit security level (e.g. RSA-2048, P-224) | Deprecated |
| After 2035 | All quantum-vulnerable public-key algorithms | Disallowed |
Replacement algorithms are ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) or SLH-DSA (FIPS 205) for signatures, plus LMS / XMSS (SP 800-208) for stateful signing use cases.
CNSA 2.0: national security systems
CNSA 2.0 specifies ML-KEM-1024, ML-DSA-87, LMS / XMSS, AES-256 and SHA-384 / SHA-512, and sets per-category milestones. The goal is for national security systems to be quantum-resistant by 2035:
| System category | Support & prefer CNSA 2.0 by | Use exclusively by |
|---|---|---|
| Software & firmware signing | 2025 | 2030 |
| Web browsers, servers & cloud services | 2025 | 2033 |
| Traditional networking equipment (VPNs, routers) | 2026 | 2030 |
| Operating systems | 2027 | 2033 |
| Niche equipment | 2030 | 2033 |
| Custom applications & legacy equipment | Update or replace by 2033 | |
Always check the latest published versions of NIST IR 8547 and the NSA CNSA 2.0 advisories, as timelines may be refined.
What the timelines mean for your roadmap
- Signing comes first. Firmware and software signing has the earliest exclusive-use date. Start with secure boot and code-signing roots of trust (QBoot).
- Networks next. VPNs and routers must use CNSA 2.0 exclusively by 2030 (QVPN).
- Web and cloud by 2033. Public-facing TLS and APIs need hybrid then pure PQ support (QGate).
- Inventory underpins everything. Every milestone assumes you know where your cryptography is (QScan).