Post quantum cryptography, or PQC, means public key algorithms designed to resist attacks from quantum computers as well as ordinary ones. NIST published its first three standards in August 2024. The practical first step is not swapping algorithms but finding where your systems use the vulnerable ones.
What did NIST actually standardize?
NIST's PQC project page lists three principal standards released as Federal Information Processing Standards in August 2024:
- FIPS 203, a module lattice based key encapsulation mechanism called ML-KEM.
- FIPS 204, a module lattice based digital signature standard called ML-DSA.
- FIPS 205, a stateless hash based digital signature standard called SLH-DSA.
A key encapsulation mechanism lets two parties establish a shared secret key over a public channel. That key then feeds ordinary symmetric encryption. FIPS 203 defines three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, in increasing security strength and decreasing performance. The standard says ML-KEM is believed to be secure even against adversaries with a quantum computer.
The page for FIPS 203 also carries a planning note dated 17 November 2025 about an issue to be corrected in a future revision, with an errata spreadsheet. Check that before you code against the text.
Why does this matter before a quantum computer exists?
NIST describes quantum computers as machines that may be years or decades away but could eventually break many widely used cryptographic systems. Two timelines meet here. Migration of real systems takes years. And data protected by today's public key exchange that an adversary records now could be decrypted later if such a machine arrives. Which data that matters for depends on how long it must stay secret: a session token expires in minutes, a medical record or design file may not.
NIST's draft transition report, IR 8547, states an expected approach. The project page summarizes it: NIST will deprecate and ultimately remove quantum vulnerable algorithms from its standards by 2035, with high risk systems moving earlier. Treat that as a planning input from a draft document, and read the final text when it appears.
What are the three first moves?
Constructed example: a payments company has a customer API behind TLS, a code signing pipeline, an internal VPN and a set of encrypted backups. Nobody knows which libraries negotiate which algorithms.
- Inventory. NIST says organizations must identify where vulnerable algorithms are used. Look at TLS endpoints, VPNs, certificates, code signing keys, SSH, and the crypto libraries inside your dependencies and firmware. A dependency inventory or software bill of materials helps because many algorithm choices live in third party code.
- Prioritize by data lifetime. Rank systems by how long the data must stay confidential and how hard the system is to update. The backups and the signing keys outrank a short lived session.
- Plan for agility. Make algorithm choices configuration, not code. Ask vendors for their PQC roadmaps in writing and ask for ability to change algorithms without a re-architecture.
What should you avoid?
- Do not invent your own post quantum scheme. Use the standardized ones.
- Do not wait for a perfect date. The decision to start is cheap, while the inventory takes a long time.
- Do not assume symmetric encryption and hashing are in the same boat. The standards NIST finalized address key establishment and signatures, the public key side.
- Do not ignore signatures. Long lived signing keys and certificates need a plan too.
How to check or apply this
- Run a crypto inventory of one service this month, end to end, and write down every algorithm and key length.
- Mark each finding as key exchange, signature or symmetric.
- Identify which items depend on vendors or libraries you do not control.
- Add PQC support to your procurement questions.
- Pilot ML-KEM in a non-critical path once your libraries support it, and test performance and compatibility.
- Revisit the NIST project page twice a year, since transition guidance is still being finalized.
Quick check
Which NIST standards make up the first PQC set?
FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for signatures and FIPS 205 (SLH-DSA) for stateless hash based signatures, all published in August 2024.
Do we need to wait for a working quantum computer?
No. NIST says organizations should begin migrating now, mainly because inventory and replacement take years.
Sources
- NIST, Post-Quantum Cryptography project
- NIST FIPS 203, ML-KEM
- NIST IR 8547 (initial public draft), Transition to Post-Quantum Cryptography Standards
Last reviewed: 18 October 2026.
