History of transitions

DES was a federal standard for 24 years before its key was shown to fall to a single machine in days. AES followed three years after that demonstration. Triple DES, the stopgap, stayed approved for another 22 years.

MD5 was published in 1992 and collisions were found twelve years later. The IETF took another seven years to say in an RFC that MD5 is not acceptable for signatures.

NIST set a 2010 end date for SHA-1 in signatures a year after the first attack was announced, and the web's certificate authorities stopped issuing SHA-1 certificates ten years after it. Browsers rejected the remaining certificates a month before the first real collision was published. Git still names content by SHA-1.

NIST allowed 1024-bit keys through 2010 and disallowed them for signatures after 2013. The web PKI, browser root stores and the DNS root followed over the next three years. The largest key factored in public is still 829 bits.

RC4 was in the first TLS standard. When practical plaintext recovery was published in 2013 it protected about half of TLS traffic. The IETF prohibited it two years later and the three main browsers switched it off within the following eighteen months.

SSL 3.0 lived 18 years before POODLE and was prohibited eight months after it. TLS 1.0 and 1.1 were disabled by the browsers in 2020, more than a decade after TLS 1.2 and a year before the RFC that formally deprecated them.

WEP shipped in the first Wi-Fi standard and its RC4 key schedule was broken four years later. WPA2 became mandatory for certified products in 2006, but the Wi-Fi Alliance did not bar TKIP-only modes until 2015. WPA3 arrived in 2018, a year after KRACK.

The GSM SIM authentication algorithm was broken in 1998 and the A5/1 cipher was published the next year. Replacements were specified by 2002, but A5/1 stays in service until a 2G network is switched off, which is still happening operator by operator.

The Crypto-1 cipher in MIFARE Classic cards was reverse engineered and broken within a year of the first public look at the chip. About 200 million cards were in use. Transport schemes took a decade to decide on replacements, and the chip is still sold.

SSH-1's integrity check was broken in 1998 and SSH-2 was standardised in 2006. OpenSSH removed the SSH-1 server in 2016, SHA-1 RSA signatures in 2021 and DSA in 2025, ten years after first disabling it.

The root was signed five years after the DNSSEC RFCs, its ZSK grew to 2048 bits six years after that, and the KSK was first rolled in 2018. SHA-1 signing algorithms were marked not recommended in 2019 and had fallen to a small fraction of their peak by 2022.

AES reached Kerberos in 2008. DES was deprecated by RFC in 2012 and RC4 in 2018, but Windows domain controllers kept assuming RC4 for accounts without a declared type until 2026.

IKEv2 was published seven years after IKEv1. DES was barred from IKEv2 and ESP in 2017 and triple DES set to SHOULD NOT in ESP. IKEv1 itself was moved to Historic in 2023, 25 years after it was published.

Suite B was announced in 2005 and NSA said it would move to quantum-resistant algorithms ten years later. CNSA 2.0 named the replacements in 2022 and expects the transition for national security systems to be complete by 2035.