Key takeaways
- 1Final since August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).
- 2Still in draft as of October 2026: FIPS 206 (FN-DSA, from Falcon) and the HQC key-establishment standard, expected as FIPS 207.
- 3Firmware and code signing can use the stateful hash-based schemes LMS and XMSS today, under NIST SP 800-208.
Final standards
On 13 August 2024 NIST published its first three post-quantum Federal Information Processing Standards. They are the baseline every migration plan should start from.
- FIPS 203, ML-KEM (from CRYSTALS-Kyber): key encapsulation for establishing shared keys, the replacement for RSA and elliptic-curve key exchange. Parameter sets ML-KEM-512, -768 and -1024; ML-KEM-768 is the common default, and CNSA 2.0 requires ML-KEM-1024 for national security systems.
- FIPS 204, ML-DSA (from CRYSTALS-Dilithium): the general-purpose digital signature, the replacement for RSA and ECDSA signatures. CNSA 2.0 requires ML-DSA-87.
- FIPS 205, SLH-DSA (from SPHINCS+): a stateless hash-based signature. Slower and larger, but its security rests only on hash functions, which makes it a conservative backup to ML-DSA.
In progress
Two more standards are on the way, and neither should be treated as final until NIST publishes it.
- FIPS 206, FN-DSA (from Falcon): compact lattice signatures, useful where signature size matters, such as certificates and constrained devices. The draft was submitted for approval in August 2025; the final standard is expected around late 2026 or 2027.
- HQC: a code-based key-encapsulation mechanism selected in March 2025 as a backup to ML-KEM, built on different maths so that one breakthrough cannot take out both. NIST planned a draft standard (expected as FIPS 207) in 2026 and a final standard in 2027.
- Additional signatures: NIST is running a separate competition for further signature schemes with different trade-offs. None is standardised yet.
Stateful hash-based signatures
LMS and XMSS, approved in NIST SP 800-208 since 2020, are mature and quantum-safe. They are stateful: each private key can sign only a fixed number of messages, and reusing a state breaks security. That makes them a good fit for firmware and software signing, where signing happens in controlled environments, and CNSA 2.0 names them for exactly that.
Retiring the old algorithms
NIST's draft transition plan, NIST IR 8547 (initial public draft, November 2024), proposes deprecating quantum-vulnerable public-key algorithms at the 112-bit security level, including RSA-2048 and P-256, after 2030, and disallowing all quantum-vulnerable public-key algorithms after 2035. It was still a draft at our last review, but US federal policy now leans on the same dates.
Which algorithm for which job
- TLS, VPN and other key exchange: hybrid X25519 + ML-KEM-768 today; ML-KEM-1024 where CNSA 2.0 applies.
- General signatures, PKI and authentication: ML-DSA, with FN-DSA as an option once final.
- Firmware and code signing: LMS or XMSS now, ML-DSA or SLH-DSA where state management is impractical.
- Long-term archives: re-encrypt or re-wrap keys with AES-256, and protect key exchange with ML-KEM.
- Hardware: check that your HSMs and cryptographic modules have FIPS 140-3 validations that include the new algorithms.
Sources
- NIST FIPS 203: ML-KEM (opens in a new tab)
- NIST FIPS 204: ML-DSA (opens in a new tab)
- NIST FIPS 205: SLH-DSA (opens in a new tab)
- NIST IR 8547 (draft): Transition to post-quantum cryptography standards (opens in a new tab)
- NIST SP 800-208: Stateful hash-based signature schemes (opens in a new tab)
General information, not legal or regulatory advice. Standards and deadlines move; check the primary source before relying on a date.