{
  "name": "NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when",
  "description": "Per-algorithm status under NIST guidance for the post-quantum cryptographic transition. Each record is one algorithm or key-length configuration with its current approval status (approved, acceptable, deprecated, restricted, disallowed, legacy use), the date at which the status changes, and the recommended replacement. Drawn from three NIST publications: IR 8547 (post-quantum transition timeline), SP 800-131A Rev 2 (current algorithm status rules) and Rev 3 draft (upcoming changes), and FIPS 203/204/205 (the post-quantum replacement standards). The key deadlines: quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) deprecated after 2030, disallowed after 2035; SHA-1 and 224-bit hashes deprecated through 2030, disallowed thereafter. AES-256 and SHA-2/SHA-3 are NOT on the deprecation schedule. Answers 'when is RSA deprecated?', 'is AES-256 affected by the post-quantum transition?', 'what replaces ECDSA?', and 'what is the current NIST status of 3DES?'",
  "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/",
  "licence": "US government publication \u2014 public domain",
  "last_verified": "2026-08-15",
  "stale_after": "2027-02-11",
  "sources": [
    "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
    "https://csrc.nist.gov/pubs/sp/800/131/a/r2/final",
    "https://csrc.nist.gov/projects/post-quantum-cryptography",
    "https://csrc.nist.gov/pubs/ir/8547/ipd"
  ],
  "records": [
    {
      "algorithm": "224-bit hash functions",
      "purpose": "hashing",
      "current_status": "Acceptable",
      "transition_status": "Scheduled for retirement (SP 800-131A Rev 3 draft)",
      "replacement": "SHA-256 or higher",
      "nist_document": "SP 800-131A Rev 3 draft (via EncryptionConsulting summary)",
      "id": "224-bit-hash-functions",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/224-bit-hash-functions/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "SHA-1 and 224-bit hashes are being retired, but for classical-strength reasons unrelated to the quantum public-key transition."
    },
    {
      "algorithm": "AES-256",
      "purpose": "encryption",
      "current_status": "Approved",
      "transition_status": "No change planned",
      "replacement": "N/A",
      "nist_document": "IR 8547 (not on deprecation schedule, per EncryptionConsulting summary)",
      "id": "aes-256",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/aes-256/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "It defines the formal approval status (approved, acceptable, deprecated, restricted, disallowed, or legacy use) of specific algorithms and key lengths, and it is the document a FIPS-validated implementation is measured against. The current finalized version is SP 800-131A Revision 2, published in March 2019. NIST released an initial public draft of Revision 3 in October 2024. Rev. 3 proposes moving the minimum classical security strength from 112 bits to 128 bits at the end of 2030, retires ECB confidentiality mode and DSA signature generation, and schedules the retirement of SHA-1 and 224-bit hash functions. To avoid forcing organizations through two separate transitions, NIST plans to fold the asymmetric-algorithm transition into the post-quantum transition rather than enforcing a separate 128-bit step for public-key algorithms. As of mid-2026, Revision 3 remains a draft, so Revision 2 is the version currently in force. What Is Not on the Schedule A common misreading is that everything cryptographic must change. It does not. The deprecation and disallowance timeline targets public-key cryptography specifically. AES-256 is not on the schedule: Grover&#8217;s algorithm offers only a quadratic speedup against symmetric ciphers, leaving AES-256 with roughly 128 bits of effective quantum security, which is acceptable for the foreseeable future. SHA-2 and SHA-3 are not on the public-key schedule: These hash families remain secure against quantum attacks at appropriate output sizes. (SHA-1 and 224-bit hashes are being retired for unrelated classical-strength reasons.) The exposure is public-key: <https://www.encryptionconsulting.com/education-center/what-is-rsa/>",
      "verified_fields": [
        "algorithm",
        "current_status",
        "purpose"
      ]
    },
    {
      "algorithm": "Classical algorithms below 112-bit security strength",
      "purpose": "all cryptographic purposes",
      "current_status": "Disallowed",
      "transition_status": "No change planned (already disallowed under Rev 2)",
      "replacement": "Algorithms meeting minimum 112-bit security strength",
      "nist_document": "SP 800-131A Rev 2 (March 2019)",
      "id": "classical-algorithms-below-112-bit-security-strength",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/classical-algorithms-below-112-bit-security-strength/",
      "source": "https://csrc.nist.gov/pubs/sp/800/131/a/r2/final",
      "source_quote": "provides more specific guidance for transitions to the use of stronger cryptographic keys and more robust algorithms"
    },
    {
      "algorithm": "DSA (signature generation)",
      "purpose": "digital signature",
      "current_status": "Deprecated",
      "transition_status": "Disallowed (SP 800-131A Rev 3 draft proposes retirement)",
      "replacement": "ML-DSA (FIPS 204)",
      "nist_document": "SP 800-131A Rev 3 draft (via EncryptionConsulting summary)",
      "id": "dsa-signature-generation",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/dsa-signature-generation/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "Rev. 3 proposes moving the minimum classical security strength from 112 bits to 128 bits at the end of 2030, retires ECB confidentiality mode and DSA signature generation, and schedules the retirement of SHA-1 and 224-bit hash functions."
    },
    {
      "algorithm": "ECB mode",
      "purpose": "encryption",
      "current_status": "Acceptable",
      "transition_status": "Disallowed (SP 800-131A Rev 3 draft proposes retirement)",
      "replacement": "CBC, CTR, GCM, or other approved modes",
      "nist_document": "SP 800-131A Rev 3 draft (via EncryptionConsulting summary)",
      "id": "ecb-mode",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/ecb-mode/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "Rev. 3 proposes moving the minimum classical security strength from 112 bits to 128 bits at the end of 2030, retires ECB confidentiality mode and DSA signature generation, and schedules the retirement of SHA-1 and 224-bit hash functions."
    },
    {
      "algorithm": "ECDH",
      "purpose": "key establishment",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "ML-KEM (FIPS 203)",
      "nist_document": "IR 8547, Section 3 (via EncryptionConsulting summary)",
      "id": "ecdh",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/ecdh/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) are deprecated after 2030 and disallowed after 2035",
      "verified_fields": [
        "algorithm"
      ]
    },
    {
      "algorithm": "ECDSA",
      "purpose": "digital signature",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "ML-DSA (FIPS 204)",
      "nist_document": "IR 8547, Section 3 (via EncryptionConsulting summary)",
      "id": "ecdsa",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/ecdsa/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) are deprecated after 2030 and disallowed after 2035",
      "verified_fields": [
        "algorithm"
      ]
    },
    {
      "algorithm": "EdDSA",
      "purpose": "digital signature",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "ML-DSA (FIPS 204)",
      "nist_document": "IR 8547, Section 3 (via EncryptionConsulting summary)",
      "id": "eddsa",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/eddsa/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "ECDSA , EdDSA, RSA-PSS, RSA PKCS#1 v1.5), and key-establishment schemes including RSA key transport, elliptic-curve Diffie-Hellman (ECDH), and finite-field Diffie-Hellman. All are broken by Shor",
      "verified_fields": [
        "algorithm"
      ]
    },
    {
      "algorithm": "Falcon",
      "purpose": "digital signature",
      "current_status": "Selected for standardization",
      "transition_status": "Pending FIPS standard",
      "replacement": "N/A",
      "nist_document": "PQC project page",
      "id": "falcon",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/falcon/",
      "source": "https://csrc.nist.gov/projects/post-quantum-cryptography",
      "source_quote": "Falcon digital signature algorithm and <https://csrc.nist.gov/news/2025/hqc-announced-as-a-4th-round-selection> HQC key encapsulation mechanism were selected for ongoing standardization; that process is underway. This process continues with a longer-term effort that solicited additional algorithms for digital signature schemes that could serve as a backup to ML-DSA or that could address unique use cases. Learn more on the <https://csrc.nist.gov/projects/pqc-dig-sig> Additional Digital Signature Schemes page. HQC was selected for standardization on March 11, 2025.",
      "verified_fields": [
        "algorithm",
        "current_status",
        "purpose"
      ]
    },
    {
      "algorithm": "Finite-field Diffie-Hellman",
      "purpose": "key establishment",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "ML-KEM (FIPS 203)",
      "nist_document": "IR 8547, Section 3 (via EncryptionConsulting summary)",
      "id": "finite-field-diffie-hellman",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/finite-field-diffie-hellman/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) are deprecated after 2030 and disallowed after 2035"
    },
    {
      "algorithm": "HQC",
      "purpose": "key establishment",
      "current_status": "Selected for standardization",
      "transition_status": "Pending FIPS standard",
      "replacement": "N/A",
      "nist_document": "PQC project page (selected March 2025)",
      "id": "hqc",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/hqc/",
      "source": "https://csrc.nist.gov/projects/post-quantum-cryptography",
      "source_quote": "HQC was selected for standardization on March 11, 2025.",
      "verified_fields": [
        "algorithm",
        "current_status"
      ]
    },
    {
      "algorithm": "ML-DSA (FIPS 204)",
      "purpose": "digital signature",
      "current_status": "Approved",
      "transition_status": "No change planned",
      "replacement": "N/A",
      "nist_document": "FIPS 204 (August 2024)",
      "id": "ml-dsa-fips-204",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/ml-dsa-fips-204/",
      "source": "https://csrc.nist.gov/projects/post-quantum-cryptography",
      "source_quote": "Module-Lattice-Based Digital Signature Standard (ML-DSA)",
      "verified_fields": [
        "purpose"
      ]
    },
    {
      "algorithm": "ML-KEM (FIPS 203)",
      "purpose": "key establishment",
      "current_status": "Approved",
      "transition_status": "No change planned",
      "replacement": "N/A",
      "nist_document": "FIPS 203 (August 2024)",
      "id": "ml-kem-fips-203",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/ml-kem-fips-203/",
      "source": "https://csrc.nist.gov/projects/post-quantum-cryptography",
      "source_quote": "Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)"
    },
    {
      "algorithm": "Quantum-vulnerable public-key algorithms (general)",
      "purpose": "digital signature and key establishment",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "Post-quantum standards (FIPS 203, 204, 205)",
      "nist_document": "IR 8547 (Initial Public Draft, November 12, 2024)",
      "id": "quantum-vulnerable-public-key-algorithms-general",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/quantum-vulnerable-public-key-algorithms-general/",
      "source": "https://csrc.nist.gov/pubs/ir/8547/ipd",
      "source_quote": "This report describes NIST\u2019s expected approach to transitioning from quantum-vulnerable cryptographic algorithms to post-quantum digital signature algorithms and key-establishment schemes."
    },
    {
      "algorithm": "RSA key transport",
      "purpose": "key establishment",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "ML-KEM (FIPS 203)",
      "nist_document": "IR 8547, Section 3 (via EncryptionConsulting summary)",
      "id": "rsa-key-transport",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/rsa-key-transport/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "key-establishment schemes including RSA key transport, elliptic-curve Diffie-Hellman (ECDH), and finite-field Diffie-Hellman",
      "verified_fields": [
        "algorithm"
      ]
    },
    {
      "algorithm": "RSA PKCS#1 v1.5 (signatures)",
      "purpose": "digital signature",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "ML-DSA (FIPS 204)",
      "nist_document": "IR 8547, Section 3 (via EncryptionConsulting summary)",
      "id": "rsa-pkcs-1-v1-5-signatures",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/rsa-pkcs-1-v1-5-signatures/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "ECDSA , EdDSA, RSA-PSS, RSA PKCS#1 v1.5), and key-establishment schemes including RSA key transport, elliptic-curve Diffie-Hellman (ECDH), and finite-field Diffie-Hellman. All are broken by Shor"
    },
    {
      "algorithm": "RSA-PSS",
      "purpose": "digital signature",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "ML-DSA (FIPS 204)",
      "nist_document": "IR 8547, Section 3 (via EncryptionConsulting summary)",
      "id": "rsa-pss",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/rsa-pss/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "ECDSA , EdDSA, RSA-PSS, RSA PKCS#1 v1.5), and key-establishment schemes including RSA key transport, elliptic-curve Diffie-Hellman (ECDH), and finite-field Diffie-Hellman. All are broken by Shor",
      "verified_fields": [
        "algorithm"
      ]
    },
    {
      "algorithm": "RSA (signatures)",
      "purpose": "digital signature",
      "current_status": "Approved",
      "transition_status": "Deprecated after 2030, Disallowed after 2035",
      "replacement": "ML-DSA (FIPS 204)",
      "nist_document": "IR 8547, Section 3 (via EncryptionConsulting summary)",
      "id": "rsa-signatures",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/rsa-signatures/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) are deprecated after 2030 and disallowed after 2035"
    },
    {
      "algorithm": "SHA-1",
      "purpose": "hashing",
      "current_status": "Deprecated",
      "transition_status": "Disallowed (SP 800-131A Rev 3 draft proposes retirement)",
      "replacement": "SHA-2 or SHA-3",
      "nist_document": "SP 800-131A Rev 2 / Rev 3 draft (via EncryptionConsulting summary)",
      "id": "sha-1",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/sha-1/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "SHA-1 and 224-bit hashes are being retired, but for classical-strength reasons unrelated to the quantum public-key transition.",
      "verified_fields": [
        "algorithm"
      ]
    },
    {
      "algorithm": "SHA-2 family",
      "purpose": "hashing",
      "current_status": "Approved",
      "transition_status": "No change planned",
      "replacement": "N/A",
      "nist_document": "IR 8547 (not on deprecation schedule, per EncryptionConsulting summary)",
      "id": "sha-2-family",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/sha-2-family/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "SHA-2 and SHA-3 are not on the public-key schedule: These hash families remain secure against quantum attacks at appropriate output sizes."
    },
    {
      "algorithm": "SHA-3 family",
      "purpose": "hashing",
      "current_status": "Approved",
      "transition_status": "No change planned",
      "replacement": "N/A",
      "nist_document": "IR 8547 (not on deprecation schedule, per EncryptionConsulting summary)",
      "id": "sha-3-family",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/sha-3-family/",
      "source": "https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/",
      "source_quote": "SHA-2 and SHA-3 are not on the public-key schedule: These hash families remain secure against quantum attacks at appropriate output sizes."
    },
    {
      "algorithm": "SLH-DSA (FIPS 205)",
      "purpose": "digital signature",
      "current_status": "Approved",
      "transition_status": "No change planned",
      "replacement": "N/A",
      "nist_document": "FIPS 205 (August 2024)",
      "id": "slh-dsa-fips-205",
      "url": "https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/slh-dsa-fips-205/",
      "source": "https://csrc.nist.gov/projects/post-quantum-cryptography",
      "source_quote": "Stateless Hash-Based Digital Signature Standard (SLH-DSA)",
      "verified_fields": [
        "purpose"
      ]
    }
  ]
}