Plan a post quantum migration by inventorying where you use public key cryptography, ranking systems by how long their data must stay secret, and testing NIST's new standards in those places first. NIST finalized three standards in August 2024 and says they can and should be put into use now.
Which standards exist?
NIST's post quantum cryptography project lists three principal standards released in August 2024:
- FIPS 203, the module lattice based key encapsulation mechanism standard, known as ML-KEM, for establishing shared keys.
- FIPS 204, the module lattice based digital signature standard, ML-DSA.
- FIPS 205, the stateless hash based digital signature standard, SLH-DSA.
NIST's page also says the Falcon signature algorithm and the HQC key encapsulation mechanism were selected for ongoing standardization, which is underway. Check the project page for current status before relying on either.
What is the timeline?
NIST's draft transition report, NIST IR 8547, published as an initial public draft on 12 November 2024, lays out the planned approach for moving from quantum vulnerable public key algorithms to post quantum ones. The project page says NIST will deprecate and ultimately remove quantum vulnerable algorithms from its standards by 2035, with high risk systems moving much earlier. The draft was open for comment until 10 January 2025, so check whether a final version has replaced it and what intermediate dates it sets.
None of this is a prediction of when a quantum computer will break current cryptography. The migration timeline is driven by how long the move takes and by the risk of recorded data being decrypted later.
Why start before the threat is real?
Two reasons. First, long lived secrets. Data encrypted today and recorded by an adversary could be decrypted years later if the key exchange used is breakable then. If the information must stay confidential for decades, the clock started already. Second, effort. Cryptography is embedded in protocols, certificates, hardware, firmware and third party products, so changing it takes years.
NIST's National Cybersecurity Center of Excellence runs a migration project with industry and federal partners to demonstrate tools for finding and prioritizing vulnerable systems and to develop migration guidance. It is worth watching.
What are the steps?
1. Inventory. Find every use of public key cryptography: TLS endpoints, VPNs, code signing, certificates, SSH, document signing, hardware modules, library dependencies and vendor products.
2. Rank. Score each use by how long the protected data must stay secret and how hard the system is to change.
3. Choose targets. For key establishment, ML-KEM is the standardized option. For signatures, ML-DSA and SLH-DSA.
4. Test. Check performance and size. Post quantum keys and signatures are larger, which can break assumptions in protocols, certificates and embedded devices.
5. Plan crypto agility. Design so that algorithms can be swapped without rewriting the application.
6. Pressure suppliers. Ask vendors for their roadmap.
7. Roll out in stages, starting with the highest risk systems.
Constructed example: the long lived archive
A company stores signed contracts and customer records that must remain confidential for thirty years. Its inventory shows the archive is protected by a key exchange built on a quantum vulnerable algorithm. It ranks that system first, ahead of a customer web portal with short lived sessions, and pilots ML-KEM in the archive transfer path first. The portal moves later on its vendor's schedule. The company is invented, but the ranking logic is the point.
Where does software come in?
Cryptographic algorithms hide in libraries your code depends on. An inventory of dependencies, such as one produced by Safeguard's SBOM and dependency scanning, shows which cryptographic libraries are present and in which versions, which is a starting point for the crypto inventory. It does not replace scanning your network endpoints and certificates.
How to check or apply this
- Assign an owner for the migration.
- Build a cryptography inventory covering endpoints, certificates, libraries and vendors.
- Rank systems by secrecy lifetime and difficulty of change.
- Read FIPS 203, 204 and 205 and the current NIST transition guidance.
- Pilot in a low risk system and measure size and speed impact.
- Add algorithm agility requirements to new projects and contracts.
- Review the plan annually as NIST publishes updates.
Quick check
Which NIST standard replaces current key exchange?
FIPS 203, ML-KEM, is the standardized key encapsulation mechanism for establishing shared keys.
Should we wait until quantum computers exist?
NIST says the new standards can and should be put into use now. Inventory and planning take years, and recorded data may be decrypted later.
Sources
- NIST, Post-Quantum Cryptography project
- NIST IR 8547 initial public draft, Transition to Post-Quantum Cryptography Standards
Last reviewed: 18 October 2026.
