referencesource/nist-cryptographic-algorithm-deprecation-schedule

NIST cryptographic algorithm deprecation schedule: what is approved, deprecated, and disallowed, and when

Canonical, always-current version: https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/ Machine-readable: https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/data.json — this mirror is a point-in-time copy.

• —Last verified: 2026-08-16
• —Stale after: 2027-02-12 (past this date, prefer the canonical copy — it re-verifies on a cadence this snapshot does not)
• —Records: 21

Per-algorithm status under NIST guidance for the post-quantum cryptographic transition. Each record is one algorithm or key-length configuration with its current approval status (approved, acceptable, deprecated, restricted, disallowed, legacy use), the date at which the status changes, and the recommended replacement. Drawn from three NIST publications: IR 8547 (post-quantum transition timeline), SP 800-131A Rev 2 (current algorithm status rules) and Rev 3 draft (upcoming changes), and FIPS 203/204/205 (the post-quantum replacement standards). The key deadlines: quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, finite-field DH) deprecated after 2030, disallowed after 2035; SHA-1 and 224-bit hashes deprecated through 2030, disallowed thereafter. AES-256 and SHA-2/SHA-3 are NOT on the deprecation schedule. Answers 'when is RSA deprecated?', 'is AES-256 affected by the post-quantum transition?', 'what replaces ECDSA?', and 'what is the current NIST status of 3DES?'

Provenance — what every record carries

Every record carries source (the URL the value was read from) and source_quote (a verbatim quote from that page stating it). A value you cannot check against its page is indistinguishable from an invented one; these can all be checked. Each record is also individually addressable on the canonical site at its url.

Licence position

US government publication — public domain

Facts are not copyrightable; what this dataset takes from each source is a fact plus a short attributed quote linking back to the page that states it.

Sources

• —https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/
• —https://csrc.nist.gov/projects/post-quantum-cryptography

Fields

See any record in data/records.jsonl — field names are self-describing, and the canonical page for each record renders them with labels: https://referencesource.org/nist-cryptographic-algorithm-deprecation-schedule/