When do RSA and ECC actually expire?

What exactly did NIST publish on October 27?

The final version of NIST IR 8547, Transition to Post-Quantum Cryptography Standards — approved on October 21, 2026 and released on October 27, 2026 (NIST announcement, 2026-10-27). It formally obsoletes the initial public draft of November 12, 2024 and turns a two-year-old proposal into NIST's standing migration guidance. It is a roadmap, not a new algorithm standard: it names which algorithms inside existing NIST standards are quantum-vulnerable, maps each to the post-quantum replacements published on August 13, 2024 (FIPS 203 / ML-KEM for key establishment, FIPS 204 / ML-DSA and FIPS 205 / SLH-DSA for signatures), and attaches the retirement schedule. NIST mathematician Dustin Moody, in the release announcement: “We understand there's not one strategy that fits all use cases” (NIST news, 2026-10-27).

Which dates are now locked in?

Two, and after 23 months of public comment they did not move: RSA and elliptic-curve cryptography at the ≥112-bit classical security strengths in use today will be deprecated after 2030 and disallowed in FIPS-validated modules after 2035 (NIST IR 8547, final, 2026-10-27). “Deprecated” will mean usable at the user's own risk; “disallowed” will mean out of FIPS validation entirely.

On top of that clock sits the binding federal overlay: Executive Order 14412 (2026-06-22) and OMB memo M-26-15 (2026-06-24) will require post-quantum key establishment on US federal high-value assets and high-impact systems by December 31, 2030, and post-quantum digital signatures on them by December 31, 2031 (EO 14412 / OMB M-26-15, via Cloudflare, 2026-06-23). NSM-10 (2022) keeps 2035 as the overall federal migration target. The house clock post, the PQC standards clock, tracks this same calendar from the research side.

What changed from the November 2024 draft?

On the core dates: nothing — and that is the news. The initial public draft of 2024-11-12 proposed deprecate-after-2030 / disallow-after-2035 (NIST IR 8547 ipd); the final version confirms both, now as standing guidance. Around those fixed dates, the document did absorb two years of movement: HQC, selected on March 11, 2025 as the fifth algorithm and backup to ML-KEM, appears with its FIPS still under development (NIST, 2025-03-11); the EO 14412 / M-26-15 deadlines of June 2026 are integrated; a FIPS for a FALCON-derived signature scheme is listed as under development; ML-KEM-768 is named the recommended default for key establishment; and the schedule replaces the older SP 800-57 projection that would have disallowed 112-bit public-key schemes on January 1, 2031 (all: NIST IR 8547, final, 2026-10-27). Rosetta Quantum's indicator board recorded the draft values at seeding and the final values this week: same numbers, different legal weight.

Is anything actually broken today?

No — and the final report does not claim otherwise. As of October 29, 2026, the public record shows 0 RSA-2048 or ECC-256 keys broken by a quantum computer and 0 public breaches attributed to a quantum attack (Rosetta Quantum documentary review, re-verified 2026-10-29). The schedule exists because migration is slow and data lives long, not because something fell: IR 8547 cites the harvest-now-decrypt-later threat — traffic recorded today will become readable in the future if a cryptographically relevant quantum computer arrives within the data's confidentiality lifetime — and notes that past cryptographic migrations took 10 to 20 years (NIST IR 8547, final, 2026-10-27). It also notes the asymmetry: signatures are not exposed to harvest-now-decrypt-later, which is why confidentiality migrates first. On when such a machine could exist, the house position is a sealed, refutable bet — RQ-PRED-QDAY-001: floor 2031, window 2033–2039 — a judgment, never a measurement; see the Q-Day post and how far today's hardware is from RSA-2048.

What should a security manager do with these dates?

Treat them as the reference clock even outside the US federal perimeter. If you sell into or operate US federal systems, the dates will bind you through FIPS validation and procurement. If you do not, they will still function as the de facto global benchmark: NCSC UK published its own milestones on March 20, 2025 — discovery of your cryptography by 2028, high-priority migration by 2031, full migration by 2035 (NCSC UK, 2025-03-20). The order of operations in IR 8547 is itself the decision frame: inventory first (you cannot migrate what you have not discovered), then prioritize key establishment (FIPS 203) for sensitive, long-lived data, because harvest-now-decrypt-later threatens confidentiality today while signatures can wait longer; hybrid classical+PQC is accepted as the more conservative route, at extra computational cost (NIST IR 8547, final, 2026-10-27). The deadline arithmetic behind that ordering is Mosca's inequality — if migration time plus data lifetime exceeds the time to a cryptographically relevant quantum computer, you are already late (Mosca, ePrint 2015/1075) — and this channel will dedicate a full piece to it. Meanwhile, part of the stack has already moved without waiting for anyone's inventory: ≈67% of human HTTPS requests on Cloudflare's network already negotiated post-quantum key agreement by April 15, 2026 (Cloudflare Radar, 2026-04-15).

PQC Board — status as of 2026-10-29

The LATAM angle — what a company in the region should prepare while its regulators publish no deadline — is covered in the house's LATAM PQC piece.

What we don't know

Whether 2030/2035 will survive contact with reality, in either direction: a faster-than-expected cryptanalytic or hardware surprise would make them late, and a prolonged absence of one could soften enforcement in practice — no measurement available today fixes those dates. When the HQC and FALCON-derived FIPS will be published: IR 8547 says “under development” without dates. How regulators outside the US and UK will map onto this clock: as of 2026-10-12, 0 of the 5 LATAM financial regulators Rosetta tracks had published a PQC deadline. What compliance will cost: IR 8547 publishes no migration cost figures, and the public record offers none at comparable rigor. And a fresher network-wide PQC traffic share than Cloudflare's ≈67% of 2026-04-15: we did not find a newer dated primary reading today.

Rosetta Quantum publishes dated verdicts with raw, reproducible data and a source next to every number. This is educational content, not a product claim and not compliance advice for any specific system.