up:: NIST IR 8547
Deprecation vs Disallowance
What is the difference between deprecated and disallowed?
Deprecated means the algorithm is still permitted, and the risk of continuing to use it now has to be formally accepted by the data owner. Disallowed means prohibited for the stated purpose for the stated purpose, with a defined legacy-use status for already-protected data.
One is a clock. The other is a wall. Treating them as the same word is what produces both false urgency and false comfort, and it is the most common error in reading a transition schedule.
The short version:
- Deprecated: still permitted, with the security risk formally accepted. The “you may, but you are on the clock” state.
- Disallowed: prohibited for the stated purpose, no exceptions.
- Legacy use: permitted only to process already-protected data, such as decrypting old ciphertext or verifying an old signature.
- The years are 2030 and 2035, and 2030 does not apply to everything. It reaches 112-bit-strength public-key algorithms only.
- The most common mistake in the field is applying 2030 to 128-bit algorithms. P-256, X25519 and Ed25519 have a single deadline, and it is 2035.
What does deprecated mean?
Still permitted, with a formal acceptance of risk attached.
NIST IR 8547 defines it as use that “carries security risk that the data owner has to formally accept.” That formality is the substance of the state. An organization continuing to use a deprecated algorithm is not out of compliance; it is on record as having accepted a named risk.
In SP 800-131A, the classical transition instrument, deprecation sits inside a five-state vocabulary of approved, deprecated, restricted, disallowed and legacy-use.
What does disallowed mean?
Prohibited for the stated purpose for the stated purpose, with a defined legacy-use status for already-protected data.
There is no acceptance-of-risk path around it. The precision that matters is “for the stated purpose,” because an algorithm disallowed for new protection is not thereby erased from every system. That distinction is what the legacy-use state exists to carry.
Deprecated vs disallowed at a glance
| Dimension | Deprecated | Disallowed |
|---|---|---|
| Permitted? | Yes, with formal risk acceptance | No, for the stated purpose |
| What it demands | A decision, documented, by the data owner | Removal from the stated use |
| Compliance posture | Compliant while the acceptance is on record | Non-compliant if still in that use |
| Instrument | NIST IR 8547 for quantum-vulnerable public key; SP 800-131A for classical strength | Same instruments |
| The year, public-key transition | 2030, and only for 112-bit strength | 2035, for all classical RSA, ECC and Diffie-Hellman signature and key-establishment schemes, regardless of key size |
| What it says about old data | Nothing. It governs use going forward | Nothing directly. Legacy use is the separate state that permits processing already-protected data |
Source: NIST IR 8547, “Transition to Post-Quantum Cryptography Standards,” status definitions and transition schedule, as carried in this Guide with the primary citation.
⚠️ Which algorithms does 2030 actually reach?
Only the ones at 112-bit security strength. This is where the field gets it wrong most often.
| Algorithm | Strength | Deprecated after | Disallowed after |
|---|---|---|---|
| RSA-2048 | 112 bits | 2030 | 2035 |
| RSA, ≥128-bit security | ≥128 bits | none | 2035 |
| ECDSA, 112-bit security | 112 bits | 2030 | 2035 |
| P-256, X25519, Ed25519 | 128 bits | none | 2035 |
| P-384, P-521, Curve448 | ≥192 bits | none | 2035 |
So “RSA is deprecated in 2030” is correct for RSA-2048 and wrong as a general statement. And “P-256 is deprecated in 2030” is simply wrong, because P-256 provides 128-bit strength and sits in the acceptable-until-disallowance row. Its single deadline is 2035.
The error is easy to make because RSA-2048 and P-256 are both the ubiquitous defaults of their families, so a reader who learns the 2030 date for one applies it to the other. The schedule sorts by security strength rather than by popularity.
How do they actually differ?
They differ in what they ask an organization to do, and only one of them is an engineering task.
Deprecation is a governance event. It asks a named person to look at a named risk and accept it in writing. Nothing has to be replaced on the day it takes effect, and an organization that has documented the acceptance is fully compliant.
Disallowance is an engineering deadline. No signature, no acceptance and no exception keeps the algorithm in the stated use past it.
That is why the two dates function so differently in a migration plan. The deprecation year is when the paperwork and the executive attention arrive. The disallowance year is when the systems have to have changed, and the work backs up from there rather than from the earlier date.
Where do they agree?
Both are dated states in the same schedule, applied to the same algorithms, in instruments issued by the same body.
Neither one is about a break. An algorithm moves through these states on a published timeline built from projected risk rather than in response to a demonstrated compromise.
And neither of them erases anything. A disallowed algorithm can still be present in systems for legacy use, which is the state that governs old data.
What about legacy use?
Permitted only to process already-protected data, such as decrypting old ciphertext or verifying a signature made years ago.
This is the state most migration plans forget, and it is the reason a completed migration still has old algorithms in it. Removing the ability to verify historical signatures is not a migration; it is data loss. The distinction the Guide draws at Deprecation, Not Deployment is exactly this one.
Why does the vocabulary matter so much?
Because the two words produce opposite behaviors from the same executive.
Told an algorithm is deprecated, a reasonable executive schedules a decision. Told it is disallowed, the same executive schedules a project. Reversing them either burns a year of budget on urgency that was not there, or loses a year that was needed.
And the compliance consequence is asymmetric. Missing a deprecation date produces an undocumented risk acceptance, which is a finding. Missing a disallowance date produces prohibited cryptography in production, which is a different order of problem.
Common misconceptions
“Deprecated means banned.” It means permitted with formal risk acceptance.
“Everything classical is deprecated in 2030.” The 2030 step reaches 112-bit-strength public-key algorithms. Stronger parameters have a single deadline in 2035.
“P-256 has to be gone by 2030.” P-256 provides 128-bit strength and is acceptable until disallowance in 2035.
“Disallowed means we must delete it.” It is prohibited for the stated purpose. Legacy use for already-protected data is a separate, permitted state.
“A bigger key resets the clock.” For quantum-vulnerable public-key algorithms, 2035 applies regardless of key size, because the problem is the algorithm rather than the parameter.
“These are laws.” NIST IR 8547 is guidance, and its force comes from the instruments and mandates that reference it.
Questions people ask
Is RSA banned in 2030? RSA-2048 becomes deprecated in 2030, meaning permitted with formal risk acceptance. RSA at any size is disallowed after 2035.
What is the actual deadline? For anything quantum-vulnerable in the public-key layer, 2035. The 2030 date is a strength-specific deprecation rather than a general one.
Does deprecation require action? It requires a documented risk acceptance by the data owner, which is a governance action rather than an engineering one.
Can we get an exception past disallowance? Disallowance is defined as prohibited for the stated purpose with no exceptions. Legacy use is a separate permitted state for already-protected data.
Which of my algorithms are at 112 bits? RSA-2048 and P-224 are the common examples. P-256, X25519 and Ed25519 are 128-bit and are not in the 2030 step.
Who does this bind? Federal agencies and FISMA-covered systems follow it as a compliance obligation, and its reach extends further because regulators, insurers and procurement programs align to NIST.
Does hitting 2035 mean we are done? It means the stated uses have changed. Data protected under the old algorithms still exists, which is what legacy use and re-encryption address.
Last verified 2026-08-10 · Maintained by Addie LaMarr, LaMarr Labs. Work with Addie at lamarrlabs.com.