PQC standardization is the process by which standards bodies, led by NIST, selected and published cryptographic algorithms that resist quantum attacks. NIST ran a multi-round evaluation from 2016, announced its first winners in 2022, and finalized the standards on August 13, 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).
Post-quantum cryptography (PQC) standardization is how the world agrees on quantum-resistant algorithms so that different systems can use them interoperably and securely. Led by NIST, the process began in 2016, announced its first selected algorithms in 2022, and produced finalized standards on August 13, 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), with more to follow.
Key Takeaways
- Standardization matters because interoperability and security depend on everyone agreeing on the same vetted algorithms.
- NIST began its PQC standardization process in 2016 and announced its first selected algorithms in July 2022 after a multi-year, multi-round evaluation.
- The finalized standards were published on August 13, 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).
- ML-KEM (from Kyber) handles key exchange; ML-DSA (from Dilithium) is the primary signature standard; SLH-DSA (from SPHINCS+) is a hash-based backup. FN-DSA (from Falcon) is expected as FIPS 206.
- NIST IR 8547 sets the deprecation timeline: legacy public-key algorithms like RSA and ECC are deprecated after 2030 and disallowed after 2035.
Why Standardization Matters
Standardization is essential for both interoperability and security. For devices from different manufacturers, operated by different people, to communicate securely, they must agree on the same cryptographic methods; without that agreement, secure communication breaks down, much like a city where everyone invented their own traffic rules. The foundational building blocks that need this agreement are cryptographic primitives such as AES, SHA, RSA, and ECDSA. Because quantum computers threaten several of these established public-key standards, new quantum-resistant ones had to be selected and standardized.
Bodies like NIST in the United States and the BSI in Germany lead this work. They weigh use cases, the assets being protected, advances in mathematical attacks, and expected growth in computing power, then recommend algorithms suited to the next 10, 15, and 20 years. A central challenge is choosing key sizes: larger keys increase security but cost performance and bandwidth, while smaller keys are faster but weaker. Getting that balance right, with public scrutiny, is exactly what a standardization process provides.
The Standardization Timeline
The road to standardized post-quantum cryptography spanned nearly two decades of research and evaluation:
| When | Milestone |
|---|---|
| 2006 | PQCrypto 2006 in Leuven, Belgium, the first dedicated post-quantum cryptography conference, as academia recognized the quantum threat. |
| Feb 2016 | NIST’s Dustin Moody presents ‘Post-Quantum Cryptography: NIST’s Plan for the Future’, outlining the standardization process. |
| Dec 2016 | NIST issues a formal call for proposals for quantum-resistant public-key encryption, KEMs, and digital signatures. |
| 2017 | 69 submissions are deemed complete and proper and enter evaluation. |
| July 2022 | After nearly six years and multiple rounds, NIST announces its first selected algorithms (Kyber, Dilithium, Falcon, SPHINCS+). |
| Aug 2023 | NIST publishes initial public drafts (IPD) of the three main standards for feedback. |
| Aug 13, 2024 | NIST publishes the finalized standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA). |
The Finalized Standards
The finalized algorithms were chosen for strong security, manageable key sizes, and confidence in their long-term resilience. Their original competition names were updated on standardization:
| Standard | Name (from) | Type | Purpose |
|---|---|---|---|
| FIPS 203 | ML-KEM (CRYSTALS-Kyber) | Lattice-based | Key encapsulation / key exchange |
| FIPS 204 | ML-DSA (CRYSTALS-Dilithium) | Lattice-based | Digital signatures (primary) |
| FIPS 205 | SLH-DSA (SPHINCS+) | Hash-based | Digital signatures (backup) |
| FIPS 206 (pending) | FN-DSA (Falcon) | Lattice-based | Compact digital signatures |
FIPS 203: ML-KEM (from CRYSTALS-Kyber)
ML-KEM (Module-Lattice Key Encapsulation Mechanism) secures the exchange of secret keys. It offers three parameter sets, ML-KEM-512, ML-KEM-768, and ML-KEM-1024, that trade off security against key and ciphertext size: 512 is a baseline, 768 offers stronger protection for sensitive applications, and 1024 is aimed at the highest-security, long-term needs. ML-KEM is expected to feature heavily in TLS, VPNs, and encrypted messaging.
FIPS 204: ML-DSA (from CRYSTALS-Dilithium)
ML-DSA (Module-Lattice Digital Signature Algorithm) is the primary post-quantum signature standard, a successor to RSA and ECDSA for identity verification and data integrity. Its relatively straightforward design supports secure implementation, and it is well suited to digital certificates, software signing, secure email, and authentication.
FIPS 205: SLH-DSA (from SPHINCS+)
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) provides signatures whose security rests only on hash functions, making it a conservative, mathematically different backup to the lattice-based schemes. Being stateless avoids the operational risks of tracking signing state. It trades some performance and signature size for that high assurance, which makes it attractive for firmware updates, blockchain, and long-lived critical-infrastructure use.
A fourth algorithm, FN-DSA (from Falcon), is expected to follow as FIPS 206. Falcon is valued for its very compact signatures and public keys, useful where bandwidth is tight, though its implementation is more complex. As of 2026 it remains in draft.
Algorithm Deprecation: The NIST IR 8547 Timeline
Standardizing the new algorithms is only half the story; the old ones must be retired. NIST’s draft report IR 8547 lays out a phased transition, listing the legacy public-key algorithms to be deprecated and then disallowed. The headline dates:
| Algorithm family | Security strength | Transition |
|---|---|---|
| RSA (signatures and key establishment) | 112-bit | Deprecated after 2030, disallowed after 2035 |
| 128-bit and above | Disallowed after 2035 | |
| ECDSA / EdDSA | 112 to 128-bit and above | Deprecated after 2030 (112-bit); disallowed after 2035 |
| Finite-field and elliptic-curve DH / MQV | 112-bit | Deprecated after 2030, disallowed after 2035 |
| 128-bit and above | Disallowed after 2035 |
Symmetric algorithms are treated very differently: AES-128, AES-192, and AES-256 all remain approved (security categories 1, 3, and 5), because symmetric cryptography is only modestly affected by quantum attacks. The clear message of IR 8547 is that public-key cryptography must move to ML-KEM and ML-DSA, and NIST encourages early adoption in hybrid mode (pairing a post-quantum algorithm with a classical one) for a smooth, secure transition toward a quantum-safe future by 2035.
How Encryption Consulting Helps
Understanding the standards is the first step; applying them across a real environment is the challenge. Encryption Consulting’s PQC Advisory Services provide expert-led cryptographic assessment, a migration strategy aligned to the finalized NIST standards (ML-KEM, ML-DSA, SLH-DSA) and the IR 8547 timeline, and hands-on implementation, including hybrid deployments. Combined with cryptographic discovery and inventory (CBOM), we help you find where deprecated algorithms live and transition to quantum-safe cryptography on schedule. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What is PQC standardization?
PQC standardization is the process by which standards bodies, led by NIST, evaluate, select, and publish cryptographic algorithms that resist attacks from quantum computers. Standardization ensures that different systems and manufacturers use the same vetted algorithms, which is essential for both interoperability and security. NIST’s process began in 2016, announced its first selected algorithms in July 2022, and produced the finalized standards, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), on August 13, 2024.
When did NIST finalize the post-quantum cryptography standards?
NIST published the first finalized post-quantum cryptography standards on August 13, 2024. These are FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). This followed the initial selection of winning algorithms in July 2022 and the release of initial public drafts in August 2023. The process itself began in 2016 with a call for proposals, and it involved multiple rounds of public evaluation over several years. A fourth algorithm, FN-DSA (Falcon), is expected to follow as FIPS 206.
What are FIPS 203, 204, and 205?
They are NIST’s finalized post-quantum cryptography standards. FIPS 203 is ML-KEM (from CRYSTALS-Kyber), a lattice-based key encapsulation mechanism for key exchange. FIPS 204 is ML-DSA (from CRYSTALS-Dilithium), a lattice-based algorithm and the primary digital signature standard. FIPS 205 is SLH-DSA (from SPHINCS+), a hash-based signature scheme that acts as a conservative backup. ML-KEM offers three parameter sets (512, 768, 1024) balancing security and size. A fourth standard, FN-DSA (from Falcon), is expected as FIPS 206.
Why did PQC standardization take so long?
Cryptographic standardization is deliberately slow because the stakes are enormous: an algorithm that later proves weak, after global deployment, would be catastrophic. NIST ran a multi-round, multi-year process starting in 2016, with open public analysis in which many candidates were broken or set aside, exactly the scrutiny that builds confidence. Balancing security, performance, and key sizes added further complexity. The result, finalized in August 2024, is a set of algorithms that have withstood years of expert cryptanalysis before being recommended for worldwide use.
When do legacy algorithms like RSA get deprecated?
According to NIST’s draft IR 8547, legacy public-key algorithms are on a phased timeline: RSA, ECDSA, and Diffie-Hellman variants at 112-bit strength are deprecated after 2030 and disallowed after 2035, with the goal of completing the transition to post-quantum cryptography by 2035. Symmetric algorithms like AES-128, AES-192, and AES-256 remain approved, since symmetric cryptography is only modestly affected by quantum computers. Organizations should begin migrating public-key cryptography to ML-KEM and ML-DSA now.
What is hybrid mode in PQC adoption?
Hybrid mode means using a post-quantum algorithm together with a classical one (for example, combining ML-KEM with an existing elliptic-curve key exchange) so that the connection stays secure even if one of the two has an unexpected weakness during the transition. NIST encourages this approach for early adoption because it provides a safety net while the new algorithms gain real-world maturity. It lets organizations gain quantum resistance now without betting everything on a single new algorithm, easing a smooth and secure migration.
Prepare for the Standardized Post-Quantum Era
The standards are final and the deprecation clock is set. Explore Encryption Consulting’s PQC Advisory Services to assess your cryptography and build a migration roadmap aligned to NIST’s finalized standards and the IR 8547 timeline.