# NIST SP 800-131A Rev. 3 Draft: Cryptographic Transition Schedule **Source**: https://quantumsequrity.com/blog/nist-sp-800-131a-transition **Category**: Standards --- [← Back to Blog](../../blog) Standards # NIST SP 800-131A Rev. 3 Draft: Cryptographic Transition Schedule 8 min read Algorithms age. NIST SP 800-131A, "Transitioning the Use of Cryptographic Algorithms and Key Lengths", is the document that says when an algorithm or key length moves from acceptable to deprecated to disallowed for US federal use. NIST first published it in January 2011 and revised it in 2015 and in March 2019. Rev. 2 (March 2019) is the current final version. NIST released Rev. 3 as an initial public draft on 21 October 2024, with comments due on 4 December 2024; as of October 2026 NIST had not published a final Rev. 3. This post explains the status terms, what Rev. 2 says today, what the Rev. 3 draft proposes, and where post-quantum algorithms fit. ## The Status Terms The Rev. 3 draft uses four terms: - **Acceptable**: the algorithm and key length may be used. - **Deprecated**: the algorithm and key length may be used, but there is some risk, and the user must accept it. - **Disallowed**: the algorithm, key length, parameter set or scheme is no longer allowed for the stated purpose. - **Legacy use**: allowed only to process already protected information, such as decrypting old data or verifying old signatures. "Acceptable", "deprecated" and "disallowed" describe applying protection (encrypting, signing, establishing keys). "Acceptable" and "legacy use" describe processing information that is already protected. ## What Rev. 2 Says Today A few rows from Rev. 2 that still come up in audits: - **Two-key TDEA**: encryption disallowed; decryption allowed for legacy use. - **Three-key TDEA**: encryption deprecated through 31 December 2023 and disallowed after 2023; decryption allowed for legacy use. - **AES-128, AES-192 and AES-256**: acceptable for encryption and decryption. - **SHA-1 for signature generation**: disallowed except where NIST protocol-specific guidance specifically allows it; SHA-1 for signature verification is allowed for legacy use. - **Security strength**: less than 112 bits is disallowed for applying protection. 112 bits (for example RSA-2048) is acceptable, and the long-standing plan was to move to 128 bits from 1 January 2031. ## What the Rev. 3 Draft Proposes The draft's own summary lists these changes: - **ECB**: retired as a confidentiality mode. Encrypting with ECB would be disallowed, with decryption allowed for legacy use. - **DSA**: signature generation disallowed and verification allowed for legacy use. FIPS 186-5 (February 2023) no longer specifies DSA. - **SHA-1 and the 224-bit hash functions**: deprecated through 31 December 2030 and disallowed after that for applying cryptographic protection. - **128-bit security for block ciphers and hash functions** from 1 January 2031, as planned before. The draft notes that TDEA is disallowed as of 2024. - **112-bit classical signatures and key establishment** (such as RSA-2048 and P-224): deprecated after 31 December 2030 instead of a forced move to 128 bits. The draft proposes a one-step move to quantum-resistant algorithms rather than a step to 128-bit classical algorithms first. - **Post-quantum algorithms**: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and LMS, HSS, XMSS and XMSS^MT (SP 800-208) are listed as acceptable. The draft says NIST is developing a separate schedule for the move to quantum-resistant algorithms. That schedule is the subject of NIST IR 8547, itself an initial public draft (November 2024), which proposes deprecating 112-bit quantum-vulnerable algorithms after 2030 and disallowing all quantum-vulnerable algorithms after 2035. See [NIST IR 8547 explained](nist-ir-8547-pqc-transition). ## Security Strengths and PQC Categories NIST expresses classical security strength in bits (112, 128, 192, 256). The post-quantum standards use security categories instead, defined against the cost of attacking AES and SHA: - **Category 1** (comparable to AES-128): ML-KEM-512, SLH-DSA-128s and -128f - **Category 2**: ML-DSA-44 - **Category 3** (comparable to AES-192): ML-KEM-768, ML-DSA-65, SLH-DSA-192s and -192f - **Category 5** (comparable to AES-256): ML-KEM-1024, ML-DSA-87, SLH-DSA-256s and -256f ## Key Dates | Date | Event | |------|-------| | January 2011 | SP 800-131A first published | | 2015 | Rev. 1 | | March 2019 | Rev. 2, the current final version | | 31 December 2023 | Three-key TDEA encryption disallowed after this date (Rev. 2) | | August 2024 | FIPS 203, 204 and 205 published | | 21 October 2024 | Rev. 3 initial public draft | | 31 December 2030 | Proposed end of SHA-1 and 224-bit hashes for applying protection; proposed deprecation of 112-bit classical signatures and key establishment | | 1 January 2031 | 128-bit security for block ciphers and hash functions | | 2035 | Proposed in NIST IR 8547 (draft): all quantum-vulnerable algorithms disallowed | For national security systems, the NSA's CNSA 2.0 sets its own anticipated timetable, with a complete transition to quantum-resistant algorithms by 2035. See [the 2035 NSA CNSA deadline plan](2035-nsa-cnsa-deadline-plan). ## How the Documents Fit Together SP 800-131A is the schedule. Other documents define the algorithms and how to use them: - [SP 800-57](nist-sp-800-57-key-management) covers key management and security strengths. - SP 800-56A, 56B and 56C cover key establishment and key derivation. - SP 800-90A, 90B and 90C cover random bit generation. - FIPS 203, 204 and 205 define ML-KEM, ML-DSA and SLH-DSA, and SP 800-208 the stateful hash-based signatures. - [SP 800-227](nist-sp-800-227-hybrid) gives recommendations for key-encapsulation mechanisms. ## Where QNSQY Stands QNSQY is not FIPS 140-3 validated, and its standard build uses both NIST-approved and non-NIST algorithms. Against SP 800-131A, its algorithms sit like this: - **Acceptable NIST algorithms**: AES-256-GCM; ML-KEM-512, -768 and -1024; ML-DSA-44, -65 and -87; SLH-DSA; LMS (Business); Ed25519 signatures, as EdDSA is specified in FIPS 186-5. - **Not NIST-approved**: XChaCha20-Poly1305 (an alternative to AES-256-GCM); X25519 key agreement, which QNSQY pairs with ML-KEM in its default hybrid key exchange; the BLAKE3-based combiner of the two shared secrets; Argon2id for passwords; and FN-DSA and HQC, which NIST has selected but not yet published as standards. - **Not used**: QNSQY's own encryption and signatures do not use SHA-1, RSA, DSA, TDEA or ECB. QNSQY's approved-mode build, which is not yet released, allows only approved algorithms such as ML-KEM, ML-DSA, AES-256-GCM and SHA-2. A cryptographic bill of materials (CBOM) makes this kind of review easier because it lists the algorithms, keys and certificates in one place. Every QNSQY release since September 2026 ships a CycloneDX software bill of materials (SBOM), and QNSQY's free scan writes a CycloneDX 1.6 CBOM of the keys, certificates, encrypted files and signatures it finds in files. See [CBOM explained](cbom-crypto-bill-of-materials). ## Frequently Asked Questions ### Is SP 800-131A Rev. 3 final? No. Rev. 3 is an initial public draft released on 21 October 2024, with comments closed on 4 December 2024. As of October 2026 NIST had not published a final version, so Rev. 2 (March 2019) remains the current final document. ### What does "deprecated" mean? The algorithm and key length may still be used, but there is some risk, and the user must accept it. Deprecated uses are expected to become disallowed later. ### When does SHA-1 end? The Rev. 3 draft proposes deprecating SHA-1 and the 224-bit hash functions through 31 December 2030 and disallowing them after that for applying cryptographic protection. Under Rev. 2, SHA-1 is already disallowed for signature generation except where NIST protocol guidance allows it. ### Are ML-KEM and ML-DSA acceptable under SP 800-131A? The Rev. 3 draft lists ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) and the SP 800-208 stateful hash-based signatures as acceptable. ### What is the deadline for moving to post-quantum algorithms? NIST IR 8547, still a draft, proposes deprecating 112-bit quantum-vulnerable algorithms after 2030 and disallowing all quantum-vulnerable algorithms after 2035. For national security systems, NSA's CNSA 2.0 timetable aims for a complete transition by 2035. ## Sources 1. [NIST SP 800-131A Rev. 3 (Initial Public Draft), Transitioning the Use of Cryptographic Algorithms and Key Lengths](https://csrc.nist.gov/pubs/sp/800/131/a/r3/ipd), NIST, October 2024 2. [NIST SP 800-131A Rev. 2, Transitioning the Use of Cryptographic Algorithms and Key Lengths](https://csrc.nist.gov/pubs/sp/800/131/a/r2/final), NIST, March 2019 3. [NIST IR 8547 (Initial Public Draft), Transition to Post-Quantum Cryptography Standards](https://csrc.nist.gov/pubs/ir/8547/ipd), NIST, November 2024 4. [FIPS 186-5, Digital Signature Standard](https://csrc.nist.gov/pubs/fips/186-5/final), NIST, February 2023 5. [NIST SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes](https://csrc.nist.gov/pubs/sp/800/208/final), NIST, October 2020 ## Related Articles - [NIST IR 8547 explained](nist-ir-8547-pqc-transition) - [SP 800-57 on key management](nist-sp-800-57-key-management) - [Why RSA 2048 will break](why-rsa-2048-will-break) - [2035 NSA CNSA deadline plan](2035-nsa-cnsa-deadline-plan) - [NIST FIPS guide](nist-fips-guide) - [NIST PQC standards timeline](nist-pqc-standards-timeline) --- ### Protect Your Data Before Q-Day Arrives QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats. [Try QNSQY](../../pricing)