NIST published three post-quantum standards on 13 August 2024. FIPS 203 (ML-KEM) establishes shared secrets, so it replaces RSA and elliptic curve key exchange. FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) are digital signature standards, so they replace RSA, ECDSA and EdDSA signatures.
The three standards side by side
- FIPS 203, ML-KEM: a key-encapsulation mechanism. Two parties establish a shared secret over a public channel, then use it for symmetric encryption and authentication. Parameter sets are ML-KEM-512, ML-KEM-768 and ML-KEM-1024.
- FIPS 204, ML-DSA: a digital signature standard built on module lattices. It detects tampering, authenticates the signer and can serve as third-party evidence of who signed.
- FIPS 205, SLH-DSA: a stateless hash-based signature standard, based on SPHINCS+. Same purpose as ML-DSA, different mathematical foundation.
Both ML-KEM and ML-DSA rely on lattice problems. SLH-DSA relies on hash functions, so it gives you a signature option that does not depend on lattices.
Pick by the job
Need to protect a connection or wrap a key? Look at ML-KEM. This is the piece that addresses harvest now, decrypt later.
Need to sign code, firmware, documents or certificates? Look at ML-DSA as the general-purpose choice, and keep SLH-DSA in mind where you want a different foundation as a hedge.
One thing to avoid: treating a KEM as encryption of your data. A KEM produces a shared secret. Your application then uses that secret with a symmetric cipher, such as AES, to encrypt the actual content.
What is not here yet
Falcon was selected for ongoing standardization, and so was HQC as a second key-encapsulation option. NIST's project page lists both as in progress, not as finished standards. If you are choosing today, the three published standards are the ones you can build against.
A note on FIPS 140
Having a standard published is not the same as having a validated module. If you work with US federal buyers, check whether your cryptographic modules are validated for the algorithms you plan to use. NIST's FAQ says it will accommodate a hybrid key-establishment mode in FIPS 140 validation when combined with a NIST-approved scheme.
Whatever you pick, write the choice down with the date and the reason. When NIST adds standards or a library changes its defaults, that note tells you what to revisit. Also test the new algorithms in a staging copy of your real protocol before production, because key and signature sizes differ from what RSA and elliptic curves produced, and some fixed-size fields, message limits and database columns will not fit. Finding that in testing is cheap. Finding it during a rollout is not.
Quick check
Which standard replaces RSA key exchange?
ML-KEM in FIPS 203. It is a key-encapsulation mechanism, so the protocol changes shape slightly: one side encapsulates a secret against the other side's public key.
Is SLH-DSA just a slower ML-DSA?
They differ in more than speed. SLH-DSA is hash-based and stateless, while ML-DSA is lattice-based. Check size and performance for your use case from the standards and your library documentation.
Sources
Last reviewed: 19 October 2026.
