# AES-256 — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

For AES-256, purpose is encryption; current status is Approved; planned status is No change planned; replacement is N/A; source document is IR 8547 (not on deprecation schedule, per EncryptionConsulting summary), recorded from its source on 2026-08-15.

- **Algorithm:** AES-256 _(verified: appears in the quote below)_
- **Purpose:** encryption _(verified: appears in the quote below)_
- **Current status:** Approved _(verified: appears in the quote below)_
- **Planned status:** No change planned
- **Replacement:** N/A
- **Source document:** IR 8547 (not on deprecation schedule, per EncryptionConsulting summary)

## What the source says

> It defines the formal approval status (approved, acceptable, deprecated, restricted, disallowed, or legacy use) of specific algorithms and key lengths, and it is the document a FIPS-validated implementation is measured against. The current finalized version is SP 800-131A Revision 2, published in March 2019. NIST released an initial public draft of Revision 3 in October 2024. Rev. 3 proposes moving the minimum classical security strength from 112 bits to 128 bits at the end of 2030, retires ECB confidentiality mode and DSA signature generation, and schedules the retirement of SHA-1 and 224-bit hash functions. To avoid forcing organizations through two separate transitions, NIST plans to fold the asymmetric-algorithm transition into the post-quantum transition rather than enforcing a separate 128-bit step for public-key algorithms. As of mid-2026, Revision 3 remains a draft, so Revision 2 is the version currently in force. What Is Not on the Schedule A common misreading is that everything cryptographic must change. It does not. The deprecation and disallowance timeline targets public-key cryptography specifically. AES-256 is not on the schedule: Grover&#8217;s algorithm offers only a quadratic speedup against symmetric ciphers, leaving AES-256 with roughly 128 bits of effective quantum security, which is acceptable for the foreseeable future. SHA-2 and SHA-3 are not on the public-key schedule: These hash families remain secure against quantum attacks at appropriate output sizes. (SHA-1 and 224-bit hashes are being retired for unrelated classical-strength reasons.) The exposure is public-key: <https://www.encryptionconsulting.com/education-center/what-is-rsa/>

## Source

- https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/

Last verified: 2026-08-15. Review by: 2027-02-11.
Part of [NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when](https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/).