RSA-2048 and RSA-3072 have different futures

Published 2026-09-06 This describes NIST IR 8547 ipd — the initial public draft of November 2024 — as it stood on the date above. Its dates are proposed. If a final IR 8547 has published since you are reading this, check it: the numbers below may have moved, and the article's central caveat may no longer apply. If you have read anything about post-quantum migration in the last year, you have read that RSA is deprecated in 2030. It is one of those facts that has been repeated into the shape of a rule. It is half true, and the half that is false is the half people plan around. Here is the actual table, from NIST IR 8547, Transition to Post-Quantum Cryptography Standards : algorithm parameters transition RSA, ECDSA 112 bits of security strength Deprecated after 2030 Disallowed after 2035 RSA, ECDSA, EdDSA ≥ 128 bits of security strength Disallowed after 2035 Read the second row again. At 128 bits and above there is no 2030 row at all . RSA-3072 is not deprecated in 2030. Neither is P-256. The 2030 date applies to 112-bit strength — RSA-2048, P-224, 2048-bit finite-field Diffie-Hellman — and to nothing else. The key-establishment table (Table 4, covering finite-field DH/MQV, elliptic curve DH/MQV and RSA) has exactly the same shape. Same split, same dates. So an inventory that reports "47 uses of RSA, all deprecated in 2030" is reporting something the document does not say. Some of those uses are on a 2030 clock and some are on a 2035 clock, and which is which depends on a field most tooling does not look at. Deprecated is not disallowed The second thing worth getting right is what the two words mean, because they are not synonyms and NIST defines both: deprecated — "The algorithm and key length may be used, but the user must accept some security risk." disallowed — "The algorithm or key length is no longer allowed for applying cryptographic protection." Deprecated is a risk acceptance. You may continue, with your eyes open and presumably a note in a register somewhere.