The 2030 Completion Target
NIST IR 8547 clearly defines the expiration of current cryptographic standards. Algorithms providing 112-bit security, such as RSA-2048 and ECC P-256, face deprecation in 2030. These algorithms will be completely disallowed by 2035. Most enterprises fail to recognize that 2030 is a completion target rather than a starting point. A large financial institution with custom-built trading platforms, HSM infrastructure, TLS termination at scale, and third-party integration dependencies is looking at a migration timeline of 5 to 7 years or more. If an organization begins its cryptographic inventory in mid-2026 and takes 12 months to complete it, active migration does not start until 2027. At a 5 year migration timeline, completion falls in 2032, which misses the 2030 NIST deprecation boundary. The complexity of the transition extends the length of the migration period, which increases the risk according to Mosca’s Theorem. This logic applies to various international bodies. The German BSI requires critical infrastructure operators to complete migration by 2030, while all other organizations must finish by 2032. France’s ANSSI set a 2030 target for sensitive application migration. The UK NCSC expects phase one, which includes discovery and planning, to finish by 2028. All Federal systems must eventually migrate to quantum-resistant cryptography by 2035 under National Security Memorandum 10.
CNSA 2.0 and the 2027 Procurement Gate
The NSA Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) provides the only definitive roadmap for National Security Systems. Every new acquisition for these systems must support CNSA 2.0 algorithms from January 1, 2027. This deadline arrives in eight months. While the NIST transition focuses on the 2030 and 2035 windows, CNSA 2.0 requires exclusive use of specific algorithms by 2030. Organizations that build prototypes against earlier draft standards will need to rebuild against the final FIPS 203 and FIPS 204 specifications.
| Algorithm Function | CNSA 2.0 Approved Standard |
|---|---|
| Key Establishment | ML-KEM-1024 |
| Digital Signatures | ML-DSA-87 |
| Symmetric Encryption | AES-256 |
| Hashing | SHA-384 or SHA-512 |
The NSA excludes SLH-DSA from its suite, which reflects a preference for lattice-based constructions despite the existence of hash-based alternatives. You should understand that the NSA’s decision to exclude SLH-DSA stems from its large signature sizes. Does the exclusion of non-lattice alternatives increase systemic risk if lattice assumptions fail? The transition for National Security Systems remains aggressive; it requires that operating systems, custom applications, and cloud services reach exclusive use of CNSA 2.0 by 2033.
Data Longevity and the Mosca Calculation
The harvest now, decrypt later threat demands immediate migration for sensitive data. Adversaries collect encrypted data in transit to decrypt it once quantum computing capabilities mature. This threat impacts data with long confidentiality requirements, such as genomic datasets or long-duration financial records. For example, a genomic dataset encrypted today and retained for 25 years remains vulnerable to any quantum computer appearing within that window. Michele Mosca defines the risk through an inequality where risk is confirmed if the time remaining before a quantum computer exists is less than the time needed to migrate plus the remaining lifetime of the data.
The NIST transition is a multi-year program requiring five sequential workstreams: cryptographic inventory, risk classification, algorithm selection, phased migration, and vendor management. The inventory phase alone often lasts 6 to 18 months in large organizations. The global post-quantum cryptography market is projected to reach USD 12.4 billion by 2035, which grows from USD 1.9 billion in 2025. This growth is driven by the need to protect critical infrastructure like power grids and healthcare records. The transition remains a complex task because implementing PQC algorithms requires higher processing power, more memory, and larger network bandwidth.
The GRI 2025 survey of 44 domain experts gives a 34% probability of a CRQC by approximately 2030 and a 49% probability by approximately 2035. The median expert estimate for the arrival of such a computer falls between 2029 and 2032. For financial sectors, long-duration records must remain secure for several years to meet regulations like MiFID II or SEC Rule 17a-4. The transition for these industries involves moving away from 112-bit security algorithms that will be disallowed by 2030.
