Skip to content

Standards

The rules changed in 2024. The deadlines are set.

In August 2024 NIST approved its first post-quantum standards. Governments have put dates on the move: January 2027 for new US national security system acquisitions, and 2035 as the horizon in the US, the UK and the EU. This page sets out what each rule asks for, and where AgilePQ’s SLiM stands.

Where SLiM standsTalk to AgilePQ
THE DATES, TO SCALE202420262028203020322035~9 years to 2035Post-quantum standardsNIST · FIPS 203, 204, 205Ascon, for constrained devicesNIST · SP 800-232New national security systems: CNSA 2.0NSACyber Resilience Act in fullEUFederal key establishment post-quantumExecutive Order 14412Constrained NSS devices: CNSA 2.0 onlyNSAQuantum-vulnerable public key disallowedNIST draft · NSM-10 goal, 2035Today
Selected dates, to scale.

01Two kinds of cryptography

Two kinds of encryption. The quantum threat hits one.

Public-key cryptography sets up keys and signs data. RSA and elliptic curves do that job today, and a large enough quantum computer breaks them. Symmetric cryptography, such as AES, uses one shared key to encrypt the data itself; NIST rates it significantly less vulnerable to known quantum attacks.

PUBLIC KEYSets up keys.Signs.key establishment · signaturesSYMMETRICEncryptsthe data.one shared keyA large enough quantum computerbreaks RSA and elliptic curves. A 2025 estimate puts RSA-2048at under a week with fewer than a million noisy qubits.RSA · elliptic curvethe public-key standards in usereplaced bydeprecated after 2030disallowed after 2035NIST draftML-KEM · ML-DSA · SLH-DSAFIPS 203 · 204 · 205, approved August 2024keys for the datakeys for the datasame algorithmsAESunder keys from RSA or elliptic curverecorded sessions readableAES · Asconunder keys from ML-KEMno transition expectedAES-256 for US national security systems (NSA) · Ascon for constrained devices (NIST, 2025)A large enough quantum computerbreaks RSA and elliptic curvesPUBLIC KEYsets up keys · signsRSA ·elliptic curveML-KEMML-DSA · SLH-DSAFIPS 203–205deprecated after 2030disallowed after 2035NIST draftkeys for the dataAESkeys from RSA, ECCreadableAES · Asconkeys from ML-KEMstaysSYMMETRICencrypts the data with one shared keyNIST expects no symmetric transition.
Public-key cryptography sets up the key. Symmetric cryptography uses that key to encrypt the data.A large enough quantum computer breaks RSA and elliptic curves, and with them the keys they set up, even for traffic recorded years before.NIST’s answer replaces the public-key layer. The symmetric layer stays.

Scene drawn from NIST’s draft transition plan and its post-quantum standards. Recorded traffic is the “harvest now, decrypt later” threat. The qubit estimate is one published result.

Public key · what changes

New algorithms, and dates for the old ones.

NIST’s replacements are FIPS 203 (ML-KEM) for key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. All three are public-key algorithms.

Its draft transition plan deprecates 112-bit RSA and elliptic curve after 2030 and disallows quantum-vulnerable public-key algorithms after 2035.

SLiM’s device link has no public-key step, so these do not apply to it. They can apply to the systems that carry the data on from a SLiM server.

Symmetric · what stays

AES stays. Ascon joins it for small devices.

On AES and its other symmetric standards, NIST writes: “NIST does not expect to need to transition away from these standards as part of the PQC migration.”

In 2025 NIST standardized Ascon for constrained devices, “a viable alternative when the Advanced Encryption Standard (AES) may not perform optimally”.

NSA: “symmetric algorithms are considered secure, provided the key size is sufficiently large.” That is a statement about symmetric cryptography in general, not about any particular cipher. For national security systems NSA requires AES with 256-bit keys.

02The landscape

Who asks for what, and by when.

Three kinds of document now shape encryption for connected devices: NIST’s standards, government migration deadlines, and laws on what may be sold. Each card gives what the document asks for and when, in its own words where it matters.

Standards

The algorithms

What NIST has published, and what it plans.

NIST · August 2024

FIPS 203, 204 and 205

The first post-quantum standards: ML-KEM for key establishment, ML-DSA and SLH-DSA for digital signatures. All three are public-key algorithms.

In effect from 14 August 2024

Where SLiM stands

NIST · August 2025

SP 800-232: Ascon

Lightweight authenticated encryption and hashing for constrained devices, “a viable alternative when the Advanced Encryption Standard (AES) may not perform optimally”.

Final from 13 August 2025

Where SLiM stands

NIST · November 2024 · draft

IR 8547: the transition plan

112-bit RSA and elliptic curve deprecated after 2030; quantum-vulnerable public-key algorithms disallowed after 2035. AES and other symmetric standards are not expected to transition.

Still an initial public draft

Where SLiM stands

Mandates

US government systems

Dates for federal agencies, their contractors and national security systems.

White House · May 2022

National Security Memorandum 10

Sets the goal “of mitigating as much of the quantum risk as is feasible by 2035”.

Goal: 2035

Where SLiM stands

White House · June 2026

Executive Order 14412

High-value and high-impact federal systems move to post-quantum key establishment by the end of 2030 and signatures by the end of 2031. It calls for a rule requiring covered contractors to comply with NIST’s FIPS, including post-quantum algorithms, by 31 December 2030.

31 December 2030 and 31 December 2031

Where SLiM stands

NSA · September 2022

CNSA 2.0

New national security system acquisitions must be CNSA 2.0 compliant from 1 January 2027, with AES-256 for symmetric encryption. Constrained devices: support and prefer CNSA 2.0 by 2030, use it exclusively by 2033. NSA expects the transition complete by 2035.

1 January 2027, then 2030, 2033 and 2035

Where SLiM stands

Plans

Migration in Europe and the UK

Milestones set in Europe and the UK.

EU · June 2025

Coordinated PQC roadmap

Every member state takes its first steps by 31 December 2026. High-risk use cases migrated by the end of 2030; medium-risk by 2035, and low-risk as far as feasible.

End of 2026, end of 2030, 2035

Where SLiM stands

UK NCSC · March 2025

PQC migration timelines

Migration goals and a plan by 2028; highest-priority migrations by 2031; by 2035, “Complete migration to PQC of all your systems, services and products”.

2028, 2031, 2035

Where SLiM stands

Product law

What may be sold

Rules for connected products sold in the EU and the UK.

EU · Regulation (EU) 2024/2847

Cyber Resilience Act

Products must protect the confidentiality of data they store, transmit or process, “such as by encrypting relevant data at rest or in transit by state of the art mechanisms”. Fines reach €15 million or 2.5% of worldwide annual turnover.

Reporting from 11 September 2026; in full from 11 December 2027

Where SLiM stands

EU · Delegated Regulation (EU) 2022/30

Radio Equipment Directive

Cybersecurity requirements for radio equipment, with the harmonized standards EN 18031-1, -2 and -3.

Applies from 1 August 2025

Where SLiM stands

UK · SI 2023/1007

Product Security (PSTI) regulations

Requirements for connectable products on passwords, which must be unique per product or set by the user; on how to report security issues; and on minimum security update periods.

In force from 29 April 2024

Where SLiM stands

Every date, in order

  1. 2024

    • AprUK product security law in force for connected devices.UK PSTI
    • AugNIST publishes its first post-quantum standards: FIPS 203, 204, 205.NIST

  2. 2025

    • AugEU radio-equipment cybersecurity rules apply.EU RED
    • AugNIST finalizes Ascon, its lightweight standard for constrained devices.NIST SP 800-232

  3. 2026Today

    • SepEU device makers must report actively exploited vulnerabilities.EU Cyber Resilience Act
    • DecEvery EU member state starts its post-quantum transition.EU roadmap

  4. 2027

    • JanNew US national security system acquisitions must be CNSA 2.0 compliant.NSA
    • DecEU Cyber Resilience Act applies in full: data in transit encrypted by “state of the art mechanisms”.EU Cyber Resilience Act

  5. 2028

    • UK organizations to have migration goals and plans defined.UK NCSC

  6. 2029

    • Google’s own deadline to complete its post-quantum migration.Google

  7. 2030

    • DecUS high-value federal systems must use post-quantum key establishment.Executive Order 14412
    • Constrained devices in national security systems: support and prefer CNSA 2.0.NSA
    • EU high-risk systems migrated. 112-bit RSA and elliptic curve deprecated (NIST draft).EU · NIST

  8. 2031

    • UK highest-priority migrations complete; US federal signatures post-quantum.UK NCSC · EO 14412

  9. 2033

    • Constrained devices in national security systems: CNSA 2.0 exclusively.NSA

  10. 2035

    • US goal: mitigate as much quantum risk as feasible.NSM-10
    • Quantum-vulnerable public-key algorithms disallowed (NIST draft). UK migration complete.NIST · UK NCSC

03Reading a vendor’s claim

“Compliant” is a claim. “Validated” is on NIST’s list.

NIST’s Cryptographic Module Validation Program says the correct term is “validated”. A product called “compliant” has not been through validation; a validated one has a NIST listing number, which NIST calls a certificate number, that anyone can look up. That listing is a government record. It is not the kind of digital certificate a website uses to prove who it is.

What a vendor may write

“FIPS 140-3 compliant”

In NIST’s words, the vendor “believes its product implementation meets the FIPS 140-3 requirements, but the product has not gone through the CMVP validation process.”

Independent lab testing
Not established
Verified by NIST’s CMVP
No
NIST listing (certificate) number
None

What NIST issues

“FIPS 140-3 validated”

The product “has gone through independent testing conducted by an accredited CSTL and its testing is verified by the CMVP.”

Independent lab testing
Yes, by an accredited lab
Verified by NIST’s CMVP
Yes
NIST listing (certificate) number
Issued, and listed by NIST

Four questions for any encryption claim

  1. Which document?

    A claim should name the standard: FIPS 140-3 for a module, FIPS 203 for ML-KEM, SP 800-232 for Ascon.

  2. Which listing number?

    NIST’s advice: when a vendor claims compliance, conformance or certification, “request the associated validation certificate number.”

  3. Is it on NIST’s list?

    Validated modules are listed on the CMVP’s own site. Search it by certificate number or vendor.

  4. Is the algorithm approved?

    NIST publishes the security functions approved for validated modules. For encryption it names AES; Ascon was added in September 2025.

For connected devices, NIST’s IoT baseline asks for “the ability to use demonstrably secure cryptographic modules for standardized cryptographic algorithms”.

04Where SLiM stands

Where SLiM stands, in plain words.

A buyer should not have to decode this. Nine questions, nine direct answers.

What kind of cryptography is SLiM?

Symmetric

AgilePQ’s own design, symmetric end to end. A key server provisions each device and issues session keys; there is no public-key exchange.

Is there a public-key step for a quantum computer to break?

No

SLiM uses no RSA or elliptic-curve key exchange.

Does SLiM use digital certificates?

No

Not on the device link. Devices and servers are known by the keys the key server issues, not by certificates.

Where does SLiM stop?

At your server

SLiM runs on the device and on the server that receives its data, with a key server that issues the keys. Nothing in between, such as a modem, router or cell tower, needs SLiM or can read the data. From that server on, your existing systems carry the data as they do today, with their own standards and certificates.

Has the design been reviewed outside AgilePQ?

An early version

An early version of the design was reviewed on paper in 2016 by university computer scientists engaged by its developer, who found no feasible attack on its low-power version. No independent review of today’s SLiM has been published.

Is SLiM one of NIST’s approved algorithms?

No

It is not on NIST’s list of approved security functions, which names AES for encryption and added Ascon in 2025.

Has SLiM been validated under FIPS 140-3?

No

NIST’s list of validated modules has no AgilePQ entry.

What if a contract or regulation requires approved algorithms or validated modules?

That governs

Follow the requirement. Examples: US federal systems under Executive Order 14412, and national security systems under CNSA 2.0.

What do EU product laws ask of data in transit?

An outcome

The Cyber Resilience Act asks that transmitted data be kept confidential, “such as by encrypting relevant data at rest or in transit by state of the art mechanisms”. That clause names no algorithm. Nothing on this page claims SLiM by itself makes a product conform.

SLiM was built for the devices the usual stack does not reach.

RFC 7228 says Class 1 devices “cannot easily” run TLS and related security protocols. AgilePQ measured SLiM’s full protocol at about 1,500 bytes of RAM on a 16 MHz Arm Cortex-M0. Tell AgilePQ the requirements your products face, and it will tell you plainly where SLiM fits and where it does not.

Talk about your requirementsHow SLiM works

05Sources

Sources and notes29 sources · 3 from AgilePQ’s own records
  1. 1NIST approved its first three post-quantum standards in August 2024: FIPS 203 (ML-KEM, key establishment), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, hash-based signatures). They are public-key algorithms.Federal Register 2024-17956 (effective 14 August 2024).Sourced
  2. 2NSA: “by January 1, 2027, all new acquisitions for NSS will be required to be CNSA 2.0 compliant unless otherwise noted”; symmetric encryption is AES with “256-bit keys for all classification levels”.NSA, CNSA 2.0 FAQ v2.1 (December 2024).Sourced
  3. 3National Security Memorandum 10 sets the goal “of mitigating as much of the quantum risk as is feasible by 2035”.NSM-10 (4 May 2022), via govinfo.Sourced
  4. 4UK NCSC milestones: by 2028 define migration goals and plan; by 2031 complete the highest-priority migrations; by 2035 “Complete migration to PQC of all your systems, services and products”.NCSC, PQC migration timelines (20 March 2025).Sourced
  5. 5EU roadmap: “By 31.12.2026: At least the First Steps have been implemented by all Member States”; by 31.12.2030 the transition for high-risk use cases is completed; by 2035 medium-risk is completed and low-risk completed as far as feasible.Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, v1.1 (June 2025).Sourced
  6. 6NIST SP 800-232 standardizes the Ascon family (Ascon-AEAD128, Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128) for constrained devices, “a viable alternative when the Advanced Encryption Standard (AES) may not perform optimally”.NIST SP 800-232, final (13 August 2025).Sourced
  7. 7EU Cyber Resilience Act: applies from 11 December 2027, with reporting of actively exploited vulnerabilities from 11 September 2026. Products must “protect the confidentiality of stored, transmitted or otherwise processed data … such as by encrypting relevant data at rest or in transit by state of the art mechanisms”. Fines reach EUR 15 000 000 or 2.5% of worldwide annual turnover, whichever is higher.Regulation (EU) 2024/2847, Article 71(2), Annex I Part I (2)(e), Article 64(2).Sourced
  8. 8Executive Order 14412 directs agencies to “transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030” and for digital signatures by 31 December 2031, and calls for a rule requiring covered contractors “to comply by December 31, 2030, with NIST’s FIPS, including all applicable FIPS incorporating PQC compliant algorithms.”Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (22 June 2026; Federal Register 2026-12909).Sourced
  9. 9NSA CNSA 2.0: “Niche equipment (e.g., constrained devices, large public-key infrastructure systems): support and prefer CNSA 2.0 by 2030, and exclusively use CNSA 2.0 by 2033.” “NSA expects the transition to QR algorithms for NSS to be complete by 2035.”NSA, Announcing the Commercial National Security Algorithm Suite 2.0 (September 2022).Sourced
  10. 10NIST’s draft transition plan marks RSA and elliptic-curve algorithms at 112-bit strength “Deprecated after 2030” and quantum-vulnerable public-key algorithms “Disallowed after 2035”. It is still an initial public draft.NIST IR 8547 ipd, Transition to Post-Quantum Cryptography Standards (12 November 2024).Sourced
  11. 11NIST IR 8547 (draft): “Key establishment is the means by which keys are generated and provided to the entities that are authorized to use them.” Of RSA, ECDSA, EdDSA and elliptic-curve key establishment: “These algorithms are vulnerable to Shor’s Algorithm on a cryptographically relevant quantum computer.” In network protocols, “symmetric keys that are established through the key-establishment process are used to provide confidentiality”.NIST IR 8547 ipd, Transition to Post-Quantum Cryptography Standards, sections 2.1.1, 2.1.2 and 3.1.3 (12 November 2024).Sourced
  12. 12Gidney: “a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits” (same hardware assumptions as 2019).C. Gidney, arXiv:2505.15917 (21 May 2025).Sourced
  13. 13NIST IR 8547 (draft): symmetric-key algorithms “use a single key to both apply cryptographic protection and to remove or check the protection”. NIST’s symmetric standards “are significantly less vulnerable to known quantum attacks than the public-key cryptography standards”.NIST IR 8547 ipd, sections 2.1.3 and 4.1.3 (12 November 2024).Sourced
  14. 14NIST on AES and other symmetric standards: “NIST does not expect to need to transition away from these standards as part of the PQC migration.”NIST IR 8547 ipd (12 November 2024).Sourced
  15. 15CISA, NSA and NIST: “cyber actors could target our nation’s most sensitive information now and leverage future quantum computing technology”, a threat “particularly devastating to sensitive information with long-term secrecy requirements”.NSA press release on the joint Quantum-Readiness fact sheet (21 August 2023).Sourced
  16. 16SLiM is symmetric end to end. A key server gives each device its own keys and issues session keys; the encryption changes with every packet. SLiM uses no RSA or elliptic-curve key exchange.AgilePQ, SLiM Overview v2.4 (April 2021) and SLiM Technical Overview v2.4.9 (January 2024).AgilePQ record
  17. 17NSA: “symmetric algorithms are considered secure, provided the key size is sufficiently large”, a statement about the class of algorithms, not any particular cipher.NSA, CNSA 2.0 FAQ v2.1 (December 2024).Sourced
  18. 18The EU Radio Equipment Directive cybersecurity requirements (Delegated Regulation (EU) 2022/30) apply from 1 August 2025, with harmonised standards EN 18031-1, -2 and -3.Commission Implementing Decision (EU) 2025/138 (28 January 2025).Sourced
  19. 19The UK’s Product Security and Telecommunications Infrastructure regulations “come into force on 29th April 2024”.The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007.Sourced
  20. 20The UK PSTI security requirements for manufacturers cover “Passwords”, which “must be— (a) unique per product; or (b) defined by the user of the product”; “Information on how to report security issues”; and “Information on minimum security update periods”.SI 2023/1007, Schedule 1, Security requirements for manufacturers.Sourced
  21. 21NIST’s Cryptographic Module Validation Program: “The correct the term is validated” — a vendor calling a product “compliant” only “believes” it meets the requirements, “but the product has not gone through the CMVP validation process.”NIST CMVP FAQ, SG-7 and P-18 (updated 21 August 2026).Sourced
  22. 22NIST CMVP: accredited laboratories “test the cryptographic module against all applicable requirements as specified in FIPS 140-2 or FIPS 140-3”. “If a vendor is making a claim of compliance, conformance or certification to the FIPS 140 standards, request the associated validation certificate number.” “Having a validated product means that it has gone through independent testing conducted by an accredited CSTL and its testing is verified by the CMVP. A validated product will have a CMVP issued certificate number.” “For a list of all the CMVP validated modules, please visit Validated Modules.”NIST CMVP FAQ, P-9, SG-7 and P-18 (updated 21 August 2026).Sourced
  23. 23NIST’s list of security functions approved for validated modules names, under “Block Cipher”, the “Advanced Encryption Standard (AES)”; “three-key Triple-DES is only approved for decryption, unwrapping or CMAC verification for legacy use”. Its change log for 2 September 2025 reads “Added: SP 800-232 (Ascon)”. SLiM is not on the list.NIST CMVP, SP 800-140C: Approved Security Functions, section 6.2 and change log (page updated 21 August 2026).Sourced
  24. 24NIST’s IoT device baseline includes “the ability to use demonstrably secure cryptographic modules for standardized cryptographic algorithms”.NIST IR 8259A, IoT Device Cybersecurity Capability Core Baseline (May 2020).Sourced
  25. 25In 2016 two university computer scientists, engaged by the developer of the design SLiM grew from, reviewed an early version of that design on paper. They found no feasible attack on its low-power version, and wrote that no review can establish a cipher’s security outright. No independent review of today’s SLiM has been published.Design review, second round (August 2016), in AgilePQ’s records.AgilePQ record
  26. 26A search of NIST’s validated-modules list for the vendor “AgilePQ” returns “No certificates match the search criteria” on the active, historical and revoked lists.NIST CMVP, Validated Modules search (searched 14 October 2026).Sourced
  27. 27RFC 7228: Class 1 devices “cannot easily talk to other Internet nodes employing a full protocol stack such as using HTTP, Transport Layer Security (TLS), and related security protocols”.IETF RFC 7228, section 3.Sourced
  28. 28AgilePQ measured about 800 bytes of RAM for the standalone SLiM library and about 1,500 bytes for the full protocol, on a 16 MHz Arm Cortex-M0 compiled at -O3.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  29. 29Google: “We’re setting a timeline for post-quantum cryptography migration to 2029.” “The threat to encryption is relevant today with store-now-decrypt-later attacks.”Google (25 March 2026).Sourced