NIST has finalized three post-quantum standards: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA), a hash-based signature backup. All were published on 13 August 2024. A fourth signature algorithm and a second key mechanism are still in standardization.
What does each standard do?
FIPS 203 specifies ML-KEM, a key-encapsulation mechanism. Two parties use it to agree on a shared secret over a public channel, and then use that secret with symmetric algorithms to protect traffic. NIST's abstract says ML-KEM is believed secure even against adversaries with a quantum computer. Three parameter sets are defined, trading size and speed for strength.
FIPS 204 specifies ML-DSA, for generating and verifying digital signatures. Signatures detect unauthorized changes to data and authenticate the signer. Same belief of security against a large quantum computer.
FIPS 205 specifies SLH-DSA, a stateless hash-based signature scheme. It rests on different mathematics from ML-DSA, which makes it a hedge: if a flaw were found in the lattice approach, a hash-based option would remain.
These are the names to use. The older labels Kyber, Dilithium and SPHINCS+ were the submission names. Procurement documents and library docs should now say ML-KEM, ML-DSA and SLH-DSA.
What is still in progress?
NIST's post-quantum project page says the Falcon signature algorithm and the HQC key-encapsulation mechanism were selected for further standardization, and that this work is underway. On 11 March 2025 NIST announced HQC as the selection from its fourth round, and a status report, NIST IR 8545, explains why HQC was chosen over BIKE and why Classic McEliece was not. NIST also continues evaluating additional signature schemes through a separate process.
Until those finish, treat Falcon and HQC as not yet standardized. Do not hard code them into products that need a published standard.
When do the old algorithms go away?
NIST's draft report IR 8547 sets out the expected transition. In its tables, quantum-vulnerable algorithms such as RSA, ECDSA and EdDSA at 112 bits of security strength would be deprecated after 2030 and disallowed after 2035, and those at 128 bits or more disallowed after 2035. The report ties the 2035 date to National Security Memorandum 10. It is an initial public draft, so confirm the final text before putting dates in a contract.
Why start before a quantum computer exists?
Encrypted traffic recorded today can be stored and decrypted later if the key exchange is breakable. That "harvest now, decrypt later" concern is why key establishment gets attention first. CISA's post-quantum initiative states the risk in the same terms: once quantum computers are powerful enough, they will break many widely used encryption and signature methods.
Signatures matter on a different clock. A forged signature is only useful if it can be accepted at the moment of verification, so long lived signatures such as firmware signing keys and root certificates need early planning.
A constructed example
A team ships an update service. Clients download a manifest signed with ECDSA and fetch the payload over TLS. Their inventory shows two quantum exposed spots: the TLS key exchange, and the manifest signature. The first can often be upgraded through a TLS library or terminating proxy once ML-KEM support is available. The second is embedded in devices already in the field, so changing it needs a firmware update that can accept a new verification algorithm. They schedule the second change first because it has the longer lead time.
How to check or apply this
- Inventory where public key cryptography is used: TLS, VPN, code signing, certificates, SSH, tokens and stored encrypted data.
- Note the algorithm and key size at each point, and who owns it.
- Rank by data lifetime. Anything that must stay confidential for many years comes first.
- Ask each vendor for a dated roadmap naming ML-KEM, ML-DSA or SLH-DSA support.
- Keep algorithm choice configurable in your own code, so a swap is a config change and not a rewrite.
- Re-read NIST's pages every quarter. Drafts and status shift.
Quick check
Is ML-KEM encryption?
Not directly. It is a key-encapsulation mechanism that establishes a shared secret. That secret is then used with a symmetric cipher to encrypt the data.
Are Kyber and ML-KEM the same thing?
ML-KEM is the standardized form of the algorithm submitted under the name Kyber. Use the FIPS 203 name when you buy, configure or document.
Sources
- NIST FIPS 203, ML-KEM
- NIST FIPS 204, ML-DSA
- NIST FIPS 205, SLH-DSA
- NIST Post-Quantum Cryptography project
- NIST, HQC announced as a 4th round selection
- NIST IR 8547 initial public draft, Transition to Post-Quantum Cryptography Standards
- CISA Post-Quantum Cryptography Initiative
Last reviewed: 18 October 2026.
