Guidance for ML-KEM, ML-DSA, SLH-DSA & more
Plain-language reference for NIST's standardized and in-progress post-quantum algorithms, sourced from the NIST PQC project.
NIST finalized its first three post-quantum cryptography standards on August 13, 2024: FIPS 203 (ML-KEM, a key-encapsulation mechanism derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, a digital signature scheme derived from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, a stateless hash-based digital signature scheme derived from SPHINCS+). A fourth KEM, HQC, was selected March 11, 2025 as a code-based backup to ML-KEM, and FN-DSA (Falcon) continues through standardization as a compact-signature alternative to ML-DSA. NIST leads this effort through its Cryptographic Technology Group within the Computer Security Division, with the National Cybersecurity Center of Excellence (NCCoE) supporting practical migration tooling and interoperability testing.
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
FIPS 203KEMThe primary standard for general-purpose key establishment -- used to agree on a shared secret over a public channel the way Diffie-Hellman/ECDH is used today. Selected as the sole KEM finalist from Round 3 for its balance of small key/ciphertext sizes and strong performance.
ML-DSA (Module-Lattice-Based Digital Signature Standard)
FIPS 204Digital SignatureNIST's primary recommended signature scheme for most applications: certificates, code signing, document signing, TLS handshakes. Favored for its balance of signature size, key size, and signing/verification speed.
SLH-DSA (Stateless Hash-Based Digital Signature Standard)
FIPS 205Digital SignatureA conservative backup signature scheme whose security rests only on the collision resistance of the underlying hash function, not on lattice hardness assumptions. Larger and slower than ML-DSA, so it's recommended as a diversity hedge rather than a default.
FN-DSA (FFT-over-NTRU-Lattice-Based Digital Signature Standard)
Draft in developmentDigital SignatureA compact lattice-based signature scheme (very small signatures) proceeding through FIPS drafting as a complement to ML-DSA for size-constrained applications.
HQC (Hamming Quasi-Cyclic)
FIPS standard forthcomingKEMA second, structurally distinct KEM chosen specifically to diversify NIST's PQC portfolio away from lattice assumptions, providing a hedge in case future cryptanalysis weakens lattice-based schemes.
Which one do I use?
- Key exchange / key establishment: use ML-KEM (FIPS 203) -- ideally in hybrid mode with your existing ECDH during the transition. HQC is a structurally distinct backup once its FIPS is finalized.
- General-purpose signatures: use ML-DSA (FIPS 204) as your default -- certificates, TLS handshakes, document signing.
- Conservative / diversified signatures: use SLH-DSA (FIPS 205) where you want security resting on hash-function collision resistance rather than lattice assumptions, accepting larger signatures and slower performance.
- Size-constrained signatures: watch FN-DSA (Falcon) as it completes standardization -- very compact signatures for constrained environments.