Proposed transitions (Tables 2 and 4): ECDSA, RSA signatures, finite-field and elliptic-curve DH and RSA key establishment at 112-bit strength (RSA-2048, P-224) are deprecated after 2030 and disallowed after 2035; at 128 bits and above (P-256, P-384, RSA-3072, Ed25519) they are disallowed after 2035. Deprecated means usable with acknowledged risk; disallowed means no longer approved for protecting data, though verifying old signatures may remain possible under legacy-use rules.
The document lists the replacements (ML-KEM, ML-DSA, SLH-DSA, LMS and XMSS), keeps symmetric algorithms with at least 128-bit security, and says application-specific guidance may require earlier migration of key establishment because of harvest-now-decrypt-later. Its comment period closed in January 2025 and no final version had been published by October 2026, though US federal policy already plans around its dates. Always cite it as a draft.