Part Two · Post-quantum cryptography
In August 2024, NIST finalized the first three federal post-quantum cryptography standards, drawn from an open, multi-year public competition. A fourth backup algorithm was added in 2025, with a fifth in progress. See the NIST Post-Quantum Cryptography Project.
| Standard | Algorithm | Math basis | Primary role |
|---|---|---|---|
| FIPS 203 | ML-KEM (from Kyber) | Module lattices | Key establishment. Three parameter sets (512 / 768 / 1024); ML-KEM-768 is the default paired with X25519 in production hybrid TLS at major browsers and CDNs. |
| FIPS 204 | ML-DSA (from Dilithium) | Module lattices | General-purpose digital signatures — TLS certificates, code signing, firmware, JWTs. Fast, but signatures (~3.3KB at level 65) are far larger than ECDSA's. |
| FIPS 205 | SLH-DSA (from SPHINCS+) | Hash functions | Conservative-assurance signatures with no dependence on lattice hardness. Slower and larger (~7.9KB signatures) — reserved for long-lived trust anchors like PKI roots and firmware. |
| Selected 2025 | HQC | Error-correcting codes | A structurally independent backup key-encapsulation mechanism, added as insurance in case future cryptanalysis weakens confidence in lattice-based math. |
| FIPS 206 (in progress) | FN-DSA (from FALCON) | Compact lattices | Smaller signatures for bandwidth- and storage-constrained environments; finalization expected in 2026–2027. |
NIST deliberately standardized algorithms built on more than one hard-math problem, so that a cryptanalytic advance against any single foundation doesn't compromise every deployed system at once.
Security rests on the difficulty of finding the shortest or nearest vector in a high-dimensional lattice — believed hard for both classical and quantum computers. Fast, compact, and the foundation of both ML-KEM and ML-DSA, making it the default choice for most new deployments.
Security depends only on the collision resistance of a well-studied hash function — a far older, more conservative assumption than lattice hardness. SLH-DSA trades speed and signature size for that conservatism, making it a deliberate hedge rather than a default.
Security relies on the difficulty of decoding a general linear error-correcting code — one of the oldest post-quantum proposals, tracing back to McEliece-era ideas from the late 1970s. HQC uses this foundation to back up ML-KEM with a mathematically independent alternative.