NIST Post-Quantum Cryptography Standards: ML-KEM, ML-DSA, and SLH-DSA Explained

NIST launched its post-quantum cryptography competition in 2016, soliciting algorithms that could survive attacks by quantum computers running Shor's and Grover's algorithms. After three public rounds of analysis — covering mathematical security, implementation security, and performance — NIST announced its first set of selections in July 2022 and published the finalized standards in August 2024. The standards cover two functions: key encapsulation, replacing the key-exchange mechanisms that set up encrypted sessions, and digital signatures, replacing the signatures that authenticate parties and data.

The urgency is not hypothetical. A class of attacks known as "harvest now, decrypt later" means an adversary with access to today's encrypted traffic can store it and decrypt it once quantum hardware matures. For data with a confidentiality lifetime measured in decades — state secrets, long-term financial records, health data — that threat is present today, before a cryptographically relevant quantum computer exists. The 2024 standards are the mechanism for addressing it.

FIPS 203 specifies ML-KEM, the Module-Lattice-Based Key Encapsulation Mechanism, derived from CRYSTALS-Kyber. It is intended for key establishment — the process by which two parties derive a shared secret over an untrusted channel — and replaces RSA key transport and Diffie-Hellman/ECDH key exchange. ML-KEM operates at three security levels (ML-KEM-512, ML-KEM-768, and ML-KEM-1024), roughly corresponding to the security of AES-128, AES-192, and AES-256. Its security is grounded in the hardness of the Module-Learning with Errors (Module-LWE) problem.

FIPS 204 specifies ML-DSA, the Module-Lattice-Based Digital Signature Algorithm, derived from CRYSTALS-Dilithium. It produces and verifies digital signatures — the cryptographic proof that a message was created by a specific party and has not been altered. ML-DSA replaces RSA-PSS and ECDSA in use cases ranging from TLS certificate signing to code signing and document authentication. It offers three parameter sets (ML-DSA-44, ML-DSA-65, and ML-DSA-87), and its security rests on the hardness of both Module-LWE and Module-Short Integer Solution (Module-SIS).

FIPS 205 specifies SLH-DSA, the Stateless Hash-Based Digital Signature Algorithm, derived from SPHINCS+. Where ML-KEM and ML-DSA depend on lattice problems, SLH-DSA depends only on the security of its underlying hash functions — SHA-256, SHA-512, or SHAKE variants — making it a structurally independent fallback. Its signatures are substantially larger than ML-DSA's, but its conservative security assumptions make it the recommended choice where a mathematically diverse backup is warranted.

FIPS 206 specifies FN-DSA, derived from FALCON. FALCON is a lattice-based signature scheme notable for producing significantly smaller signatures than Dilithium at comparable security levels, at the cost of more complex implementation requirements, particularly around its discrete Gaussian sampler. FN-DSA is intended for use cases where signature size is a binding constraint.

In March 2025, NIST announced the selection of HQC (Hamming Quasi-Cyclic) as a fourth standardized key encapsulation mechanism, derived from a different mathematical foundation — error-correcting codes — than the lattice-based ML-KEM. HQC's selection responds to the cryptographic principle of algorithm diversity: if a future breakthrough weakens lattice-based assumptions, HQC provides a fallback that does not share that vulnerability. Standardization is in progress.

A broader survey of the field by Chhetri et al. (2025) notes that the standardized algorithms — ML-KEM, ML-DSA, SLH-DSA, and FN-DSA — should be treated as the deployment baseline, while alternatives in code, multivariate, isogeny, and MPC-in-the-Head families remain active research. The key design principle is crypto-agility: systems that can substitute algorithms without full architectural rebuilds are better positioned than those hardwired to any single scheme (arXiv 2510.10436).

NIST has published supplemental guidance in SP 800-227, an initial public draft migration guide covering asset inventory, algorithm transition sequencing, and hybrid deployment models that run classical and post-quantum algorithms in parallel during the transition period. The hybrid approach, while operationally more complex, ensures that even if a post-quantum algorithm turns out to have an unforeseen weakness, the classical layer still provides protection — and vice versa against the quantum threat.

NIST has also indicated a deprecation schedule for classical public-key algorithms. RSA, ECDH, and ECDSA are expected to be deprecated for most new applications before 2030 and disallowed before 2035. Organizations should treat those dates as the outer boundary of the migration window, not the beginning of planning.

Inventory your cryptographic assets. List every system that uses RSA, ECDH, ECDSA, or ECDHE: TLS endpoints, certificate authorities, code-signing infrastructure, VPN gateways, and long-term storage encryption. NIST SP 800-227 provides a structured asset-classification approach.

Prioritize long-lived data and persistent keys first. Symmetric keys rotated daily and ephemeral TLS sessions are lower-urgency targets than root CAs, long-term storage keys, and data with a multi-decade confidentiality requirement.

Adopt hybrid schemes during transition. Running classical and post-quantum algorithms in parallel preserves the existing security guarantee while adding quantum resistance. Most major TLS libraries and hardware security modules now support hybrid key exchange.

Plan for larger artifacts. ML-KEM and ML-DSA public keys, ciphertexts, and signatures are substantially larger than their classical equivalents. Systems with hard-coded buffer sizes, protocol message limits, or certificate-chain size assumptions will need updating before PQC artifacts flow through them.