Standardization & Deadlines

Post-quantum cryptography moved from an open research question to finalized NIST standards and increasingly concrete government migration timelines over roughly a decade. This timeline traces the NIST competition, the published FIPS standards, and the government deadlines that now drive migration.

The NIST PQC standardization project

NIST ran a multi-year, open, public competition to select quantum-safe algorithms — the same model that produced AES. Candidates were submitted, cryptanalyzed by the global community, and narrowed over successive rounds.

From competition names to FIPS names

The selected algorithms were renamed as they became standards: Kyber became ML-KEM (FIPS 203), Dilithium became ML-DSA (FIPS 204), and SPHINCS+ became SLH-DSA (FIPS 205). Falcon is being standardized separately as FN-DSA (FIPS 206, in progress). NIST also runs a separate additional-signatures on-ramp — its own process with Rounds 1–3 (Round 3 began May 2026) — to broaden mathematical diversity. This is distinct from the main competition's Round 4, which concluded in March 2025 — selecting HQC, with Classic McEliece and BIKE not selected; Classic McEliece's future may still be discussed in standardization or industry channels outside NIST.

US government mandates and deadlines

Standardization is only half the story. A series of US policy actions converts the standards into binding deadlines.

NSM-10 (2022)

National Security Memorandum 10 (May 2022) directs US federal agencies to begin the transition to quantum-resistant cryptography, mandates cryptographic inventories, and sets the migration in motion across government.

NSA CNSA 2.0

The NSA's Commercial National Security Algorithm Suite 2.0 specifies the quantum-safe algorithms required for US national security systems, with an aggressive adoption schedule:

• Algorithms: ML-KEM-1024 for key establishment and ML-DSA-87 for general signatures, at the highest parameter sets.
• Software and firmware signing: the stateful hash-based signatures LMS and XMSS.
• Milestones: phased adoption with key transitions through 2030–2033, after which CNSA 2.0 algorithms become the default and then the exclusive choice for new and existing national security systems.

NIST IR 8547 — deprecation timeline

NIST Internal Report 8547 lays out the transition away from quantum-vulnerable algorithms for the broader ecosystem:

• After 2030: quantum-vulnerable public-key algorithms at 112-bit security strength are deprecated (discouraged, allowed only with risk acceptance).
• After 2035: 112-bit-strength algorithms are disallowed, and RSA/ECC/finite-field DH and other quantum-vulnerable public-key algorithms at 128-bit security strength and above are also disallowed thereafter.

What this means for your timeline

The standards are final and the deadlines are concrete. With deprecation around 2030 and a multi-year migration ahead, organizations that have not yet inventoried their cryptography are already behind the curve implied by these dates. Use these milestones as fixed anchors when planning your own migration.

Standards & references

• NIST PQC — HQC selected as additional KEM (11 Mar 2025); FIPS 203/204/205 final (13 Aug 2024)
• NIST SP 800-227 — Recommendations for KEMs (finalized Sept 2025)
• NIST IR 8547 — Transition to PQC standards (initial public draft, Nov 2024)
• NIST additional digital-signature on-ramp — Round 2 (Oct 2024)
• NSA CNSA 2.0 — algorithms advisory updated 30 May 2025
• UK NCSC — Timelines for migration to PQC (Mar 2025)
• EU — Recommendation (EU) 2024/1101 (11 Apr 2024)