NIST IR 8547 Algorithm Deprecation Timeline: What Sovereign Operators Must Do Now

The NIST IR 8547 algorithm deprecation timeline is the first authoritative federal schedule that assigns hard calendar deadlines to the phase-out of quantum-vulnerable public-key cryptography, specifically RSA, ECDSA, ECDH and finite-field Diffie-Hellman. Published in initial public draft form in 2024, it converts what had previously been a general post-quantum migration aspiration into a compliance clock that regulated organisations, including those operating sovereign infrastructure in Europe and Switzerland, cannot ignore.

What IR 8547 Actually Requires and When

NIST IR 8547 establishes a two-stage schedule. Deprecation by 2030 means the listed algorithms may no longer be used in new systems or procurements; legacy use requires documented justification and a transition plan. Disallowance by 2035 means no use whatsoever is permitted under any circumstances.

The thresholds are not uniform across all key sizes. Algorithms providing only 112-bit classical security strength, such as RSA-2048 and 192-bit elliptic curve variants, reach the deprecation threshold earlier within the 2030 window than those providing 128-bit strength. The document aligns with the security-strength tables already established in NIST SP 800-131A, which defines which key lengths correspond to which security-strength levels. In practical terms, an RSA-2048 certificate or an ECDH P-256 key exchange already sits in the zone where NIST considers use undesirable for new deployments, and both cross into full disallowance by 2035 regardless of key size.

The three post-quantum standards that replace these algorithms, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), were finalised by NIST in August 2024, giving organisations the standards-backed building blocks they need to begin migration immediately.

Mapping the Deprecation Schedule to Existing Deployments

Sovereign infrastructure operators must treat the IR 8547 timeline as an asset-inventory problem before it becomes an audit problem. The mapping exercise has three layers: identify every cryptographic primitive in use, assign it a security-strength level and an asset lifetime, and then plot it against the 2030 and 2035 thresholds.

For a typical sovereign operator, the exposure falls into several categories. TLS termination points running RSA-2048 or ECDSA P-256 certificates are the most visible. VPN gateways using ECDH for key exchange are the most operationally critical. Code-signing pipelines and document-signing services using ECDSA are the least frequently inventoried but carry the longest downstream validity requirements. Encrypted backup archives using RSA-wrapped symmetric keys represent a silent risk because the data they protect may still be sensitive well past 2035.

The Mosca Inequality as a Procurement Trigger

The Mosca inequality provides regulated organisations with a decision framework that translates cryptographic risk into procurement urgency. As Michele Mosca, co-founder of the Institute for Quantum Computing at the University of Waterloo, has stated: “The key insight of the Mosca inequality is that if the time to migrate your systems plus the time a quantum computer needs to break your encryption exceeds the sensitivity lifetime of your data, you already have a problem.”

The practical consequence for a hospital retaining patient records for 30 years, or a financial institution holding signed contracts for 15 years, is that the sensitivity lifetime of the underlying data already extends past the 2035 disallowance deadline. When you add the realistic migration time for a complex sovereign infrastructure, typically 18 to 36 months when certificate replacement, vendor qualification, and testing are included, the inequality resolves to a procurement trigger that is already overdue for most regulated entities.

This makes IR 8547 not merely a compliance checklist item but a procurement policy. Any new server, HSM, VPN gateway or signing service procured today that cannot be upgraded to ML-KEM or ML-DSA without hardware replacement creates a stranded asset before 2030.

How SP 800-131A Interacts with IR 8547

NIST SP 800-131A is the standing companion document that translates algorithm recommendations into operational restrictions for US federal systems and serves as the basis for many European and Swiss security frameworks’ contractual references. IR 8547 feeds directly into the next revision of SP 800-131A by hardening its deprecation language into disallowance language. The shift matters in practice.

When an algorithm is deprecated under SP 800-131A, certificates and encrypted archives generated using that algorithm retain their standing for legacy verification purposes. Audit trails remain intact. When an algorithm moves to disallowed, the cryptographic assurance it provides is considered broken: a signature created with a disallowed algorithm cannot be used as evidence of integrity in a regulatory proceeding that references these standards, and encrypted material protected only by a disallowed key-exchange mechanism is treated as unprotected.

For sovereign infrastructure operators this means that encrypted backup archives protected with RSA-wrapped AES keys and legal documents signed with ECDSA P-256 need to be re-processed into hybrid or purely post-quantum formats before 2035, not after. NSA CNSA 2.0 has already mandated ML-KEM and ML-DSA as the required algorithms for new US national security systems, with a 2030 deadline for new deployments, reinforcing the direction of travel.

NIS-2, DORA and GDPR Compliance Exposure

The regulatory exposure for European organisations that miss IR 8547-aligned thresholds is not theoretical. NIS-2 Article 21 requires essential and important entities to implement state-of-the-art cryptographic practices as part of mandatory risk management. DORA Article 9 imposes equivalent ICT security obligations on financial entities, with explicit requirements for cryptographic controls in ICT risk frameworks. GDPR Article 32 requires appropriate technical measures including encryption, calibrated to the risk.

Once national competent authorities, such as the BSI in Germany or ANSSI in France, incorporate IR 8547 or the EU PQC Transition Roadmap 2026-2030 thresholds into their technical guidance, reliance on deprecated algorithms constitutes a documented control gap. That gap can invalidate SOC 2 and ISO 27001 audit attestations, trigger supervisory findings under DORA’s ICT incident reporting regime, and expose data processors to claims that their encryption measures were no longer appropriate at the time of a breach.

The IBM Cost of a Data Breach Report 2024 found that the global average cost of a data breach reached USD 4.88 million in 2024, the highest figure in the report’s history (IBM, 2024). For organisations that suffer a breach and are subsequently found to have used deprecated cryptographic controls, that figure represents only the direct cost. Regulatory penalties and civil liability compound it.

The EU PQC Roadmap and the Swiss Sovereign Operator

The EU PQC Transition Roadmap 2026-2030, coordinated through ENISA and referenced in the European Cybersecurity Certification Scheme framework, sets migration milestones broadly aligned with but not identical to the NIST IR 8547 federal timeline. The EU roadmap is principle-based where IR 8547 is deadline-specific, which creates a compliance gap for operators serving both US-connected clients and EU-only clients.

Swiss-hosted sovereign operators occupy a distinctive position. Switzerland’s revised Federal Act on Data Protection (revFADP) removes the foreign-jurisdiction exposure inherent in US-controlled cloud infrastructure under the CLOUD Act and FISA 702. However, Swiss operators whose clients include EU financial institutions subject to DORA, or EU healthcare providers subject to NIS-2, must demonstrate cryptographic compliance against EU standards, not just Swiss ones. Where a Swiss operator has also signed data processing agreements referencing NIST SP 800-131A or CNSA 2.0 compliance, IR 8547 becomes contractually binding regardless of geographic location.

As Dustin Moody, NIST’s PQC project lead, has noted: “Migrating to post-quantum cryptography is not a simple drop-in replacement. Organisations need to begin inventorying their cryptographic assets now so they have time to plan and execute a careful transition” (NIST). For sovereign operators, that inventory must include not just their own systems but every third-party integration, every vendor-supplied HSM, and every software component that performs cryptographic operations, because the weakest link in a hybrid architecture determines the actual security level of the whole.

The US Office of Management and Budget required federal agencies to submit PQC migration inventories by May 2023, giving agencies until FY 2035 to complete migration of non-national-security systems (OMB Memo M-23-02, November 2022). European and Swiss regulated operators do not face the same mandatory inventory submission, but the FY 2035 federal deadline sets the de facto global clock: any infrastructure that shares cryptographic trust anchors with US federal systems, including public certificate authorities, must align with that timeline or accept the operational consequences of diverging from it.

FAQ

What is the difference between ‘deprecated’ and ‘disallowed’ under NIST IR 8547?

‘Deprecated’ means the algorithm is still permitted for legacy use but must not be used in new systems; continued use requires documented justification and a transition plan. ‘Disallowed’ means no use is permitted under any circumstances, and any system still relying on it is non-compliant. IR 8547 targets deprecation of RSA, ECDSA and ECDH by 2030 and full disallowance by 2035.

Does NIST IR 8547 apply directly to European or Swiss-hosted organisations?

IR 8547 is a US federal document and is not directly binding outside US jurisdiction. However, it shapes the EU PQC Transition Roadmap 2026-2030 and feeds into NIST SP 800-131A revisions that European financial and critical-infrastructure regulators reference contractually. Swiss operators serving US-connected clients or holding data subject to DORA or NIS-2 technical guidance face indirect alignment obligations that are real and growing.

What is the Mosca inequality and why does it matter for procurement decisions?

The Mosca inequality states that an organisation faces a cryptographic risk when the sensitivity lifetime of its data plus its migration time exceeds the time until a sufficiently powerful quantum computer exists. For long-lived assets such as medical records, legal contracts or infrastructure certificates, this calculation frequently resolves to a procurement trigger that is already overdue. Any new system that cannot be upgraded to ML-KEM or ML-DSA without hardware replacement is a stranded asset.

How do NIS-2 and DORA create compliance exposure for organisations that have not started PQC migration?

NIS-2 Article 21 and DORA Article 9 both require state-of-the-art cryptographic practices as part of mandatory risk and ICT security frameworks. Once supervisory authorities incorporate IR 8547 or EU PQC Roadmap thresholds into their guidance, reliance on deprecated algorithms constitutes a documented control gap. This gap can invalidate audit attestations, trigger supervisory findings, and expose organisations to regulatory penalties and contractual liability.

Can existing TLS certificates, signed archives and encrypted backups remain valid after 2035?

When an algorithm is disallowed under the SP 800-131A revision informed by IR 8547, its cryptographic assurance is considered broken. Archives encrypted with RSA-wrapped keys and documents signed with ECDSA do not automatically become legally invalid, but their evidential and audit value degrades significantly in any proceeding that references these standards. Organisations that need to preserve chain-of-custody arguments for historical records must plan hybrid re-encryption and re-signing workflows before 2035, not after the deadline passes.