NIST Internal Report 8547, Transition to Post-Quantum Cryptography Standards, is the roadmap for phasing out quantum-vulnerable public-key cryptography. It was released as an initial public draft in November 2024.
Treat the dates as strong direction rather than settled regulation — this is a draft, and the final document may shift. It is nonetheless the clearest published statement of when classical public-key cryptography stops being acceptable.
The two dates
Deprecated after 2030. Quantum-vulnerable public-key algorithms — RSA, ECDSA, ECDH, finite-field Diffie-Hellman — should no longer be used for new systems. Deprecation is not prohibition: continued use is permitted on a documented risk-acceptance basis.
Disallowed after 2035. The risk-acceptance option is removed. Quantum- vulnerable algorithms come out of the standards.
Which algorithms
The draft targets algorithms at roughly the 112-bit security level and the classical public-key family generally, including RSA-2048, ECDSA P-256, and ECDH groups such as X25519 and secp256r1.
Symmetric cryptography is not affected in the same way. AES-256 and SHA-384 are considered adequate against quantum attack; Grover's algorithm reduces effective symmetric security but not catastrophically.
Hybrid is not caught
Hybrid modes that combine an approved post-quantum algorithm with a classical one are not caught by the 2035 disallowance. This is deliberate, and it is the practical migration path: you are not required to remove X25519, only to stop relying on it alone.
Why 2030 is closer than it looks
Two things compress the timeline.
First, harvest-now-decrypt-later means data transmitted today is already at risk if its confidentiality lifetime extends past the arrival of quantum hardware. For a ten-year secret, 2030 is already late.
Second, nobody migrates what they have not inventoried. Discovering every internet-facing service and what cryptography it negotiates typically takes far longer than the configuration changes that follow it.