RSA
The classical public-key algorithm every jurisdiction in this dataset is migrating away from, broken in principle by Shor's algorithm on a sufficiently large quantum computer. Retirement dates vary sharply — and Hong Kong's binding standard still mandates it with no PQC provision at all.
Approved or recommended by
RSA-2048 minimum
Binding minimum for CONFIDENTIAL-classified government information, with no quantum-migration provision.
“The asymmetric encryption key length shall be at least 2048-bit for the RSA encryption.”IT Security Guidelines [G3] v10.2 (April 2025) →
Deprecated or being retired by
Will not be approved beyond 2030
“Taking into account projected technological advances in quantum computing, RSA will not be approved beyond 2030.”ASD Information Security Manual, Guidelines for Cryptography →
Scope: 112-bit security
Deprecated after 2030, disallowed after 2035
NIST IR 8547 (Initial Public Draft, Nov 2024) →Scope: 3000-bit and above key establishment use
Recommended only to 2031; beyond only combined with a quantum-safe KEM
BSI TR-02102-1, Version 2026-01 →Scope: Key exchange and signatures
The PQC Migration Handbook, 2nd edition (Dec 2024) →Scope: Standalone use for high-risk cases
Shall not be used stand-alone after end of 2030 (high-risk) / 2035 (medium-risk)
Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography v1.1 →Scope: Regulated financial institutions
“3DES 升級為 AES 256、SHA 1 升級為 SHA 2 (progressively upgrade to higher-security algorithms)”金融業後量子密碼遷移參考指引 (June 2026) →
This page lists only jurisdictions we have researched and where a primary source names a position on RSA specifically. Absence from this list is not evidence a country prohibits or ignores it -- see that country's page directly.