Post-Quantum Cryptography Standards: NIST's Final Selection Explained

After an eight-year global competition, NIST finalised the first post-quantum cryptography (PQC) standards in 2024. These standards are the foundation every organisation — from US federal agencies to European banks to Israeli defence tech firms — should now build upon.

FIPS 203 — ML-KEM (Key Encapsulation)

Module-Lattice-based Key-Encapsulation Mechanism (ML-KEM), derived from the CRYSTALS-Kyber proposal, is the standard for establishing shared secret keys between two parties over an insecure channel. It replaces the key-agreement role of Diffie-Hellman and ECDH.

• Uses lattice problems believed hard for both classical and quantum computers.
• Relatively small keys and ciphertexts compared with other PQC candidates.
• Already being integrated into TLS 1.3 as a hybrid scheme.

FIPS 204 — ML-DSA (Digital Signatures)

Module-Lattice-based Digital Signature Algorithm (ML-DSA), from CRYSTALS-Dilithium, is the primary standard for digital signatures. It replaces RSA-PSS and ECDSA in authentication, code signing and document signing.

• Strong security with reasonable signature sizes.
• Designed for high performance on modern hardware.
• Suitable for firmware signing, TLS authentication and identity systems.

FIPS 205 — SLH-DSA (Hash-Based Signatures)

Stateless Hash-Based Digital Signature Algorithm (SLH-DSA), from SPHINCS+, offers a conservative, hash-only signature scheme. It is slower and produces larger signatures, but relies on the well-studied security of hash functions rather than newer lattice assumptions.

• Ideal as a fallback where long-term conservative security is paramount.
• Useful for root-of-trust and firmware update signing.

Why Standardisation Matters

Standardisation gives organisations confidence that the algorithms have survived years of public cryptanalysis. It also unlocks procurement: US federal systems are mandated to migrate, and EU agencies (ENISA) and the UK's NCSC are aligning their guidance to the same standards, creating a coherent global baseline.

Adopting the Standards

• Hybrid first: run classical and PQC algorithms together so a weakness in either does not break security.
• Prioritise long-lived keys: root CAs, firmware signing keys and long-term archives first.
• Build crypto-agility: abstract algorithm choices so you can rotate to new standards without re-engineering.

NIST's standards are the starting line, not the finish. The migration to post-quantum cryptography is a multi-year programme that should begin now.