NIST IR 8547 draft splits RSA-2048 and RSA-3072 onto different post-quantum timelines

What the draft actually says

One of the most repeated claims in post-quantum migration planning — that NIST deprecates RSA in 2030 — is half true, and the false half is what many teams build schedules around, according to a dev.to analysis published on 6 September 2026. The post examines NIST IR 8547, "Transition to Post-Quantum Cryptography Standards," whose central table splits algorithms by security strength rather than by name.

At 112 bits of security strength — RSA-2048, ECDSA over P-224, and 2048-bit finite-field Diffie-Hellman — the document marks algorithms deprecated after 2030 and disallowed after 2035. At 128 bits and above — RSA-3072, EdDSA, and ECDSA over P-256 — there is no 2030 milestone at all; the only deadline is disallowed after 2035. The key-establishment table follows the same shape with the same dates.

The two words are not synonyms, the post stresses. NIST defines "deprecated" as usable provided the user accepts some security risk, and "disallowed" as no longer permitted for applying cryptographic protection. In budgeting terms, 2030 is when 112-bit material becomes a documented risk acceptance, while 2035 is when all quantum-vulnerable classical cryptography stops being usable for new protection, at any strength.

One caveat the author insists on: IR 8547 is still an initial public draft, published in November 2024 with a comment period that closed in January 2025. Every date in it is proposed and could move, so building contractual commitments on the 2030 and 2035 figures is premature.

Why tooling flattens the split

Security strength is not a field in a CycloneDX cryptographic bill of materials; it has to be derived from modulus size or curve — RSA-2048 gives roughly 112 bits, RSA-3072 roughly 128. The post argues that most compliance tooling models a regulation as a list of banned algorithm names with one date attached, so "RSA" gets the earlier date and the distinction disappears.

Over-strictness has a price, the author writes: a team convinced that RSA-3072 dies in 2030 builds a migration schedule five years tighter than necessary, competing for budget against work that genuinely is on the 2030 clock. The same flattening recurs elsewhere — Germany's BSI recommends rather than mandates hybrid schemes, and US Executive Order 14412 covers federal high-value systems while excluding National Security Systems, with key establishment due in 2030 and signatures in 2031.

The author's own CLI, cbomctl, attempts to model the draft correctly: it evaluates a CBOM against national post-quantum policies, keeps deprecation and disallowance as separate states scoped by strength, flags findings as draft wherever rules cite IR 8547, and reports indeterminate rather than defaulting to the stricter rule when strength cannot be derived. The post also candidly reports that the tool initially got this wrong — its strength selector was inert, so both RSA sizes produced identical verdicts until a fix derived strength from the modulus, the curve, or the CBOM's classicalSecurityLevel field.

A parallel split over hybrids

A companion dev.to post by the same author shows the precision problem repeating internationally. Germany's BSI, France's ANSSI and the EU roadmap recommend hybrid key establishment combining classical and post-quantum algorithms; Australia's ASD recommends against it without prohibiting it; and the NSA's CNSA 2.0 does not permit hybrids on national security systems outside named exceptions.

According to the post, the agencies agree on the underlying risk — Rainbow and SIKE both fell to classical cryptanalysis during the NIST competition — and disagree on the price. The NSA argues that more security products fail from implementation and configuration errors than from breaks in their underlying algorithms, so added cryptographic complexity can weaken security rather than improve it. The practical outcome: X25519MLKEM768, the hybrid construction most TLS libraries ship today, passes under BSI, ANSSI and the EU roadmap, warns under ASD and fails under CNSA 2.0. No single configuration satisfies every jurisdiction — ML-KEM-1024 clears all of them, at a performance cost nobody else demanded.

Why it matters

The RSA-2048 and RSA-3072 split turns post-quantum migration from a single deadline into an inventory problem: which keys sit at 112 bits and which at 128. Getting it wrong either wastes budget on premature migration or leaves genuinely time-limited material unplanned, and CBOM tooling that cannot express security strength cannot tell the difference. And because every circulating date comes from a draft, the soundest plan treats 2030 and 2035 as strong signals rather than settled law — and checks whether a final IR 8547 has landed before signing anything against those numbers.