FIPS 140-2 moves to historical status as post-quantum migration tightens across federal and commercial cryptography

FIPS 140-2 historical status lands September 21, 2026

FIPS 140-2 validations move to historical status on September 21, 2026. Validations in this state are removed from the active list used by federal and commercial organizations to identify acceptable cryptographic modules, so any module relied on today needs to be re-checked against the post-September-21 list before the next procurement cycle. For practitioners maintaining inventories, the immediate change is administrative: existing certificates are not invalidated, but new acquisitions and re-validations will no longer be accepted under FIPS 140-2.

Post-quantum deadlines compress RSA and ECC planning windows

Federal mandates require migration by 2030, and companies like Microsoft and Google are targeting 2029. The reason given for moving ahead of the mandate is that "harvest now, decrypt later" means protection has to be in place before adversaries can record traffic for future decryption, which forces RSA and ECC operators to treat 2029 as the practical planning horizon rather than 2030. Practitioners running certificate authorities, TLS terminators or signed software pipelines need an inventory of where RSA and ECC keys still anchor trust before the next refresh.

Algorithm selection enters public review for platform management

A presentation at the 2026 Manageability Workshop, presented by DMTF at OCP Global, examines the decision-making framework employed by the SPDM Working Group in selecting cryptographic algorithms and schemes. The session lifts what is normally an internal standards-body choice into a public venue, giving implementers of attestation, firmware integrity and device identity flows an early look at how platform-management protocols will pick between classical and post-quantum primitives. Teams that integrate SPDM-speaking hardware should track this thread because algorithm defaults decided here propagate into firmware, BMCs and supply-chain attestations.

What practitioners should do this quarter

With FIPS 140-2 validations moving to historical status on September 21, 2026, the first concrete step is to re-run module inventories against the updated list and flag any in-use certificates that lose eligibility for federal work. Second, organizations still anchoring trust on RSA or ECC should treat 2029 as the working deadline rather than 2030 and prioritize hybrid post-quantum TLS where supported, using a SHA256 Hash Generator and a Sha512 Hash Generator to verify fingerprints of new artifacts during the transition.

Third, firmware and supply-chain teams integrating SPDM should follow the SPDM Working Group's algorithm-selection track and prepare to retest attestation flows against any new defaults that emerge from the public review. Finally, any team touching encoding or transport should validate that payloads still round-trip cleanly with a Gzip Compress & Decompress check and a Text To HEX inspector as cryptography and compression defaults shift together.