asset_type: deprecation-schedule

body: Per-algorithm status under NIST guidance for the post-quantum cryptographic transition. Each record is one algorithm or key-length configuration with its current approval status (approved, acceptable, deprecated, restricted, disallowed, legacy use), the date at which the status changes, and the recommended replacement. Drawn from three NIST publications: IR 8547 (post-quantum transition timeline), SP 800-131A Rev 2 (current algorithm status rules) and Rev 3 draft (upcoming changes), and FIPS 203/204/205 (the post-quantum replacement standards). The key deadlines: quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) deprecated after 2030, disallowed after 2035; SHA-1 and 224-bit hashes deprecated through 2030, disallowed thereafter. AES-256 and SHA-2/SHA-3 are NOT on the deprecation schedule. Answers 'when is RSA deprecated?', 'is AES-256 affected by the post-quantum transition?', 'what replaces ECDSA?', and 'what is the current NIST status of 3DES?'

key_field: algorithm

licence: US government publication — public domain

title: NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

type: dataset


algorithm: 224-bit hash functions

body:
**Algorithm:** 224-bit hash functions

**Purpose:** hashing

**Current status:** Acceptable

**Planned status:** Scheduled for retirement (SP 800-131A Rev 3 draft)

**Replacement:** SHA-256 or higher

**Source document:** SP 800-131A Rev 3 draft (via EncryptionConsulting summary)

> SHA-1 and 224-bit hashes are being retired, but for classical-strength reasons unrelated to the quantum public-key transition.

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

current_status: Acceptable

purpose: hashing

replacement: SHA-256 or higher

title: 224-bit hash functions — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

type: deprecation-schedule

unverified_fields: algorithm, current_status, nist_document, purpose, replacement, transition_status


body:
**Algorithm:** AES-256

**Purpose:** encryption

**Current status:** Approved

**Planned status:** No change planned

**Replacement:** N/A

**Source document:** IR 8547 (not on deprecation schedule, per EncryptionConsulting summary)

> It defines the formal approval status (approved, acceptable, deprecated, restricted, disallowed, or legacy use) of specific algorithms and key lengths, and it is the document a FIPS-validated implementation is measured against. The current finalized version is SP 800-131A Revision 2, published in March 2019. NIST released an initial public draft of Revision 3 in October 2024. Rev. 3 proposes moving the minimum classical security strength from 112 bits to 128 bits at the end of 2030, retires ECB confidentiality mode and DSA signature generation, and schedules the retirement of SHA-1 and 224-bit hash functions. To avoid forcing organizations through two separate transitions, NIST plans to fold the asymmetric-algorithm transition into the post-quantum transition rather than enforcing a separate 128-bit step for public-key algorithms. As of mid-2026, Revision 3 remains a draft, so Revision 2 is the version currently in force. What Is Not on the Schedule A common misreading is that everything cryptographic must change. It does not. The deprecation and disallowance timeline targets public-key cryptography specifically. AES-256 is not on the schedule: Grover’s algorithm offers only a quadratic speedup against symmetric ciphers, leaving AES-256 with roughly 128 bits of effective quantum security, which is acceptable for the foreseeable future. SHA-2 and SHA-3 are not on the public-key schedule: These hash families remain secure against quantum attacks at appropriate output sizes. (SHA-1 and 224-bit hashes are being retired for unrelated classical-strength reasons.) The exposure is public-key: <https://www.encryptionconsulting.com/education-center/what-is-rsa/>

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

current_status: Approved

purpose: encryption

title: AES-256 — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

transition_status: No change planned


body:
**Algorithm:** Classical algorithms below 112-bit security strength

**Purpose:** all cryptographic purposes

**Current status:** Disallowed

**Planned status:** No change planned (already disallowed under Rev 2)

**Replacement:** Algorithms meeting minimum 112-bit security strength

**Source document:** SP 800-131A Rev 2 (March 2019)

> provides more specific guidance for transitions to the use of stronger cryptographic keys and more robust algorithms

Source: <https://csrc.nist.gov/pubs/sp/800/131/a/r2/final>

current_status: Disallowed

purpose: all cryptographic purposes

title: Classical algorithms below 112-bit security strength — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: DSA (signature generation)

body:
**Algorithm:** DSA (signature generation)

**Purpose:** digital signature

**Current status:** Deprecated

**Planned status:** Disallowed (SP 800-131A Rev 3 draft proposes retirement)

**Replacement:** ML-DSA (FIPS 204)

**Source document:** SP 800-131A Rev 3 draft (via EncryptionConsulting summary)

> Rev. 3 proposes moving the minimum classical security strength from 112 bits to 128 bits at the end of 2030, retires ECB confidentiality mode and DSA signature generation, and schedules the retirement of SHA-1 and 224-bit hash functions.

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

current_status: Deprecated

purpose: digital signature

replacement: ML-DSA (FIPS 204)

title: DSA (signature generation) — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: ECB mode

body:
**Algorithm:** ECB mode

**Purpose:** encryption

**Current status:** Acceptable

**Planned status:** Disallowed (SP 800-131A Rev 3 draft proposes retirement)

**Replacement:** CBC, CTR, GCM, or other approved modes

**Source document:** SP 800-131A Rev 3 draft (via EncryptionConsulting summary)

> Rev. 3 proposes moving the minimum classical security strength from 112 bits to 128 bits at the end of 2030, retires ECB confidentiality mode and DSA signature generation, and schedules the retirement of SHA-1 and 224-bit hash functions.

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

replacement: CBC, CTR, GCM, or other approved modes

title: ECB mode — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: ECDH

body:
**Algorithm:** ECDH

**Purpose:** key establishment

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** ML-KEM (FIPS 203)

**Source document:** IR 8547, Section 3 (via EncryptionConsulting summary)

> quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) are deprecated after 2030 and disallowed after 2035

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

purpose: key establishment

replacement: ML-KEM (FIPS 203)

title: ECDH — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

unverified_fields: current_status, nist_document, purpose, replacement, transition_status


algorithm: ECDSA

body:
**Algorithm:** ECDSA

**Purpose:** digital signature

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** ML-DSA (FIPS 204)

**Source document:** IR 8547, Section 3 (via EncryptionConsulting summary)

> quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) are deprecated after 2030 and disallowed after 2035

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: ECDSA — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: EdDSA

body:
**Algorithm:** EdDSA

**Purpose:** digital signature

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** ML-DSA (FIPS 204)

**Source document:** IR 8547, Section 3 (via EncryptionConsulting summary)

> ECDSA , EdDSA, RSA-PSS, RSA PKCS#1 v1.5), and key-establishment schemes including RSA key transport, elliptic-curve Diffie-Hellman (ECDH), and finite-field Diffie-Hellman. All are broken by Shor

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: EdDSA — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: Falcon

body:
**Algorithm:** Falcon

**Purpose:** digital signature

**Current status:** Selected for standardization

**Planned status:** Pending FIPS standard

**Replacement:** N/A

**Source document:** PQC project page

> Falcon digital signature algorithm and <https://csrc.nist.gov/news/2025/hqc-announced-as-a-4th-round-selection> HQC key encapsulation mechanism were selected for ongoing standardization; that process is underway. This process continues with a longer-term effort that solicited additional algorithms for digital signature schemes that could serve as a backup to ML-DSA or that could address unique use cases. Learn more on the <https://csrc.nist.gov/projects/pqc-dig-sig> Additional Digital Signature Schemes page. HQC was selected for standardization on March 11, 2025.

Source: <https://csrc.nist.gov/projects/post-quantum-cryptography>

current_status: Selected for standardization

nist_document: PQC project page

title: Falcon — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

transition_status: Pending FIPS standard


algorithm: Finite-field Diffie-Hellman

body:
**Algorithm:** Finite-field Diffie-Hellman

**Purpose:** key establishment

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** ML-KEM (FIPS 203)

**Source document:** IR 8547, Section 3 (via EncryptionConsulting summary)

> quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) are deprecated after 2030 and disallowed after 2035

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: Finite-field Diffie-Hellman — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: HQC

body:
**Algorithm:** HQC

**Purpose:** key establishment

**Current status:** Selected for standardization

**Planned status:** Pending FIPS standard

**Replacement:** N/A

**Source document:** PQC project page (selected March 2025)

> HQC was selected for standardization on March 11, 2025.

Source: <https://csrc.nist.gov/projects/post-quantum-cryptography>

nist_document: PQC project page (selected March 2025)

title: HQC — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

unverified_fields: nist_document, purpose, replacement, transition_status


algorithm: ML-DSA (FIPS 204)

body:
**Algorithm:** ML-DSA (FIPS 204)

**Purpose:** digital signature

**Current status:** Approved

**Planned status:** No change planned

**Replacement:** N/A

**Source document:** FIPS 204 (August 2024)

> Module-Lattice-Based Digital Signature Standard (ML-DSA)

Source: <https://csrc.nist.gov/projects/post-quantum-cryptography>

nist_document: FIPS 204 (August 2024)

title: ML-DSA (FIPS 204) — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

unverified_fields: algorithm, current_status, nist_document, replacement, transition_status


algorithm: ML-KEM (FIPS 203)

body:
**Algorithm:** ML-KEM (FIPS 203)

**Purpose:** key establishment

**Current status:** Approved

**Planned status:** No change planned

**Replacement:** N/A

**Source document:** FIPS 203 (August 2024)

> Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)

Source: <https://csrc.nist.gov/projects/post-quantum-cryptography>

nist_document: FIPS 203 (August 2024)

title: ML-KEM (FIPS 203) — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


body:
**Algorithm:** Quantum-vulnerable public-key algorithms (general)

**Purpose:** digital signature and key establishment

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** Post-quantum standards (FIPS 203, 204, 205)

**Source document:** IR 8547 (Initial Public Draft, November 12, 2024)

> This report describes NIST’s expected approach to transitioning from quantum-vulnerable cryptographic algorithms to post-quantum digital signature algorithms and key-establishment schemes.

Source: <https://csrc.nist.gov/pubs/ir/8547/ipd>

purpose: digital signature and key establishment

title: Quantum-vulnerable public-key algorithms (general) — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: RSA key transport

body:
**Algorithm:** RSA key transport

**Purpose:** key establishment

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** ML-KEM (FIPS 203)

**Source document:** IR 8547, Section 3 (via EncryptionConsulting summary)

> key-establishment schemes including RSA key transport, elliptic-curve Diffie-Hellman (ECDH), and finite-field Diffie-Hellman

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: RSA key transport — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: RSA PKCS#1 v1.5 (signatures)

body:
**Algorithm:** RSA PKCS#1 v1.5 (signatures)

**Purpose:** digital signature

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** ML-DSA (FIPS 204)

**Source document:** IR 8547, Section 3 (via EncryptionConsulting summary)

> ECDSA , EdDSA, RSA-PSS, RSA PKCS#1 v1.5), and key-establishment schemes including RSA key transport, elliptic-curve Diffie-Hellman (ECDH), and finite-field Diffie-Hellman. All are broken by Shor

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: RSA PKCS#1 v1.5 (signatures) — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: RSA-PSS

body:
**Algorithm:** RSA-PSS

**Purpose:** digital signature

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** ML-DSA (FIPS 204)

**Source document:** IR 8547, Section 3 (via EncryptionConsulting summary)

> ECDSA , EdDSA, RSA-PSS, RSA PKCS#1 v1.5), and key-establishment schemes including RSA key transport, elliptic-curve Diffie-Hellman (ECDH), and finite-field Diffie-Hellman. All are broken by Shor

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: RSA-PSS — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: RSA (signatures)

body:
**Algorithm:** RSA (signatures)

**Purpose:** digital signature

**Current status:** Approved

**Planned status:** Deprecated after 2030, Disallowed after 2035

**Replacement:** ML-DSA (FIPS 204)

**Source document:** IR 8547, Section 3 (via EncryptionConsulting summary)

> quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) are deprecated after 2030 and disallowed after 2035

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: RSA (signatures) — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


body:
**Algorithm:** SHA-1

**Purpose:** hashing

**Current status:** Deprecated

**Planned status:** Disallowed (SP 800-131A Rev 3 draft proposes retirement)

**Replacement:** SHA-2 or SHA-3

**Source document:** SP 800-131A Rev 2 / Rev 3 draft (via EncryptionConsulting summary)

> SHA-1 and 224-bit hashes are being retired, but for classical-strength reasons unrelated to the quantum public-key transition.

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

replacement: SHA-2 or SHA-3

title: SHA-1 — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: SHA-2 family

body:
**Algorithm:** SHA-2 family

**Purpose:** hashing

**Current status:** Approved

**Planned status:** No change planned

**Replacement:** N/A

**Source document:** IR 8547 (not on deprecation schedule, per EncryptionConsulting summary)

> SHA-2 and SHA-3 are not on the public-key schedule: These hash families remain secure against quantum attacks at appropriate output sizes.

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: SHA-2 family — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: SHA-3 family

body:
**Algorithm:** SHA-3 family

**Purpose:** hashing

**Current status:** Approved

**Planned status:** No change planned

**Replacement:** N/A

**Source document:** IR 8547 (not on deprecation schedule, per EncryptionConsulting summary)

> SHA-2 and SHA-3 are not on the public-key schedule: These hash families remain secure against quantum attacks at appropriate output sizes.

Source: <https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/>

title: SHA-3 family — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when


algorithm: SLH-DSA (FIPS 205)

body:
**Algorithm:** SLH-DSA (FIPS 205)

**Purpose:** digital signature

**Current status:** Approved

**Planned status:** No change planned

**Replacement:** N/A

**Source document:** FIPS 205 (August 2024)

> Stateless Hash-Based Digital Signature Standard (SLH-DSA)

Source: <https://csrc.nist.gov/projects/post-quantum-cryptography>

nist_document: FIPS 205 (August 2024)

title: SLH-DSA (FIPS 205) — NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when