Standard
NSA-mandated suite of cryptographic algorithms, including post-quantum standards, required for U.S. national security systems to adopt by set deadlines.
AWS says teams can sign binaries, container images and SBOMs with ML-DSA today, using KMS, Private CA and IAM Roles Anywhere. CNSA 2.0 mandates exclusive quantum-resistant software signatures by 2030, and AWS dates the EU CRA's full effect to December 2027.
Reality
NSA has moved its post-quantum deadline for National Security Systems to 2027, two years ahead of Cloudflare, Google and Microsoft, a dev.to post reports. That account is secondhand, so whether suppliers to those systems have to re-plan their migrations depends on what the agency's own statement says.
Reality
Trail of Bits has published SequenceHash and SequenceMAC, open C2SP specs for hashing several inputs together with SHA-2, BLAKE or RIPEMD. Protocols that hash concatenated inputs into commitments or proofs now have a written fix that does not require Keccak.
Reality
Hybrid ML-KEM is live on google.com and googleapis.com, and Cloud KMS post-quantum algorithms are generally available. The rest of the roadmap is a dated dependency schedule.
Reality
Post-quantum standards were finalised in August 2024, and NIST means to phase out most quantum-vulnerable algorithms by 2035. For banks the harder problem is finding every place RSA and ECC are written into application code.
Reality
A Forbes Tech Council argument for urgency leans on benchmarks that were never factoring runs. The part of it that survives scrutiny is still enough to justify the spend.
Reality