Standards & ComplianceJuly 21, 2026

NIST Post-Quantum Cryptography Standards Explained: ML-KEM, ML-DSA & SLH-DSA

NIST finalized the first post-quantum cryptography standards in 2024: ML-KEM, ML-DSA, and SLH-DSA. Here's what each one does and how enterprises adopt them.

Allison Seller

Chief Executive Officer

NIST Post-Quantum Cryptography Standards Explained: ML-KEM, ML-DSA & SLH-DSA

What are the NIST post-quantum cryptography standards?

In August 2024, NIST published the first finalized post-quantum cryptography standards: FIPS 203 (ML-KEM) for key encapsulation, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) for hash-based signatures. These are the algorithms the U.S. government (and, by extension, the enterprises that supply and integrate with it) will use to replace RSA and elliptic-curve cryptography before quantum computers can break them.

For a CISO, this matters because "post-quantum" is no longer a research topic. It is a published, named, standardized set of algorithms with a compliance clock attached. The question has shifted from whether to migrate to how fast, and from "which algorithm might win" to "here are the three that did." That certainty is what makes enterprise planning possible; you can now build a migration program around specific, government-backed primitives rather than betting on a moving target.

Why did it take eight years to standardize them?

The standards emerged from a global public competition NIST launched in 2016. Cryptographers worldwide submitted candidate algorithms, then spent years trying to break each other's submissions. Several early front-runners were eliminated when researchers found weaknesses, which is exactly the point. Cryptography earns trust by surviving sustained attack, not by being clever on paper. By the time ML-KEM and ML-DSA were finalized, they had endured years of concentrated cryptanalysis from the world's best.

This history should reassure enterprise leaders wary of adopting "new" cryptography. These algorithms are new as standards but old as targets. The open, adversarial process is the same one that validated the cryptography you already trust.

What does each standard actually do?

The three standards cover the two cryptographic jobs that RSA and ECC do today: exchanging keys secretly, and proving authenticity.

FIPSAlgorithmFunctionClassical EquivalentFIPS 203ML-KEM (Kyber)Key encapsulation: securely exchange keysRSA / ECDH key exchangeFIPS 204ML-DSA (Dilithium)Digital signatures: verify identity & integrityRSA / ECDSA signaturesFIPS 205SLH-DSA (SPHINCS+)Stateless hash-based signatures: a conservative backupRSA / ECDSA signatures

ML-KEM protects data in transit and at rest by securing the key exchange: the moment two parties agree on a secret key. ML-DSA and SLH-DSA protect authenticity: proving a message, document, certificate, or software update is genuine and unaltered. Most enterprises will need all three jobs covered, because confidentiality and authenticity are both foundational and both threatened.

Why are there two signature standards?

ML-DSA and SLH-DSA both produce signatures, but they rest on different mathematical foundations, and that diversity is deliberate. ML-DSA is lattice-based: fast, compact, and efficient, suitable for the vast majority of signing. SLH-DSA is hash-based: slower and with larger signatures, but built only on the security of hash functions, which are among the most battle-tested constructions in cryptography.

The reason to keep both is risk hedging. If a future breakthrough ever weakened lattice mathematics, hash-based signatures would still stand. Enterprises protecting assets that must remain trustworthy for decades (root certificates, firmware signing keys) often keep SLH-DSA in reserve for exactly those cases. This "don't bet everything on one algorithm" principle is the essence of crypto-agility, now a core enterprise requirement rather than a nice-to-have.

How do enterprises adopt the NIST standards?

Adoption is not a single upgrade you schedule for a weekend. It follows a sequence. First, discover where RSA and ECC are used across your estate, a step most organizations dramatically underestimate. Second, prioritize by data sensitivity and lifespan, because not everything needs migrating at once. Third, replace the highest-risk cryptography with ML-KEM and ML-DSA, almost always in hybrid mode first, where the classical and post-quantum algorithms run together so systems remain interoperable and nothing breaks mid-transition.

You cannot migrate what you cannot see, which is why a cryptographic bill of materials is the practical first step of any real program. And the clock is not hypothetical: federal timelines such as CNSA 2.0 set dates by which national-security systems must adopt these algorithms, and those requirements cascade to contractors, suppliers, and eventually the broader market.

Are the NIST standards enough on their own?

The algorithms are the ingredients, not the meal. Standardization solved the "which algorithm" problem, but it did not solve the enterprise problem: finding every place cryptography is used, managing keys and certificates across their lifecycle, coordinating the change across hundreds of systems, and proving compliance to auditors. That orchestration (visibility, governance, and control over your entire cryptographic estate) is where most of the real effort and risk live.

Enterprises that treat PQC as "swap the algorithm" will stall the moment they discover how much cryptography they cannot even locate. Those that treat it as a managed, ongoing capability will migrate faster and stay ready as standards evolve. To understand why the timing is non-negotiable regardless of when quantum computers actually arrive, see the Mosca inequality.

Frequently asked questions

NIST finalized FIPS 203, 204, and 205 in August 2024, following an eight-year public evaluation that began in 2016 and subjected every candidate to years of global cryptanalysis.

ML-KEM (FIPS 203) handles key encapsulation: securely exchanging encryption keys. ML-DSA (FIPS 204) handles digital signatures: verifying identity and integrity. Most enterprises need both.

Most enterprises adopt ML-KEM for key exchange and ML-DSA for signatures. SLH-DSA is a conservative hash-based signature option kept as a hedge for long-lived, high-assurance keys.

Yes, usually. Hybrid mode runs classical and post-quantum algorithms together, preserving compatibility while adding quantum resistance throughout the transition.

Yes. They are finalized government standards that survived years of public attack. The greater risk is delaying adoption while quantum-vulnerable data continues to be harvested. Project content Markdown conversion Created by you Add PDFs, documents, or other text to reference in this project. Content CONUX 10 Blogs.docx DOCX The Convergence: Why Quantum and AI Risk Are One Problem Most enterprises treat the quantum threat and AI risk as separate projects on separate roadmaps. They are the same problem wearing two faces. Walk into a typical enterprise and you will find two distinct initiatives: a quantum-readiness effort PASTED Crypto-Agility as a Business Capability, Not a Project Most organizations treat cryptographic change as a one-time migration. The ones that thrive will treat the ability to change as a permanent capability. The instinct when facing the quantum transition is to scope a project: migrate to new algorit PASTED The Board's New Fiduciary Duty: Cryptographic Oversight Boards oversee financial risk, operational risk, and cyber risk. Cryptographic risk is quietly becoming the next item they cannot afford to ignore. Corporate boards have steadily expanded their oversight as new categories of material risk emerg PASTED What “Quantum-Safe” Will Actually Mean in 2030 “Quantum-safe” is today's aspiration. By 2030 it will be a baseline expectation — and the definition will have moved well beyond swapping a few algorithms. Right now, 'quantum-safe' is a goal organizations are working toward, often understood narrowly a PASTED Your Zero-Trust Architecture Has a Cryptographic Blind Spot Zero-trust assumes nothing and verifies everything. But almost every zero-trust architecture quietly trusts one thing without question: the cryptography underneath it. Zero-trust has become the dominant security model for good reason. 'Neve PASTED What Is Post-Quantum Cryptography? A Guide for Enterprise Leaders Primary keyword: post-quantum cryptography Post-quantum cryptography (PQC) is a new generation of encryption designed to withstand attacks from quantum computers - machines powerful enough to break the cryptography that protects almos PASTED The Real Cost of a Trust Failure in the AI Era In the human era, a trust failure was a breach to be contained. In the AI era, a trust failure can propagate at machine speed before anyone is even aware it began. Organizations are used to thinking about the cost of a security incident in familiar term PASTED

The CONUX Briefing

Get the next briefing in your inbox.

Monthly deep dives on quantum resilience, AI control planes, and the infrastructure protecting tomorrow's critical systems. No noise.

Unsubscribe anytime · No spam

Continue reading

All articles

Threat Intelligence

July 20, 2026

The Real Cost of a Trust Failure in the AI Era

AI-era trust failures propagate at machine speed and scale with agent authority. See why prevention, not response, is the only economics that works.

Crypto-Agility as a Business Capability, Not a Project

Cryptographic change is now permanent, not a one-time event. See why crypto-agility must be a standing business capability, not a single migration project.

Your Zero-Trust Architecture Has a Cryptographic Blind Spot

Zero-trust verifies everything except the cryptography underneath it. See why quantum computing exposes that blind spot, and how to close it.

TC

Team Conux

Read