Which NIST Post-Quantum Algorithm Actually Applies to You

Quantum migration is all about making the switch to post-quantum cryptography before large-scale quantum computers break classical algorithms. However, while NIST has published post-quantum standards, companies have choices to make, and more standards are on their way.

Today, the NIST standards to know about are ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). In the future, additional signature schemes, such as FN-DSA (FIPS 206), may change the calculus.

ML-KEM (FIPS 203)

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is the only current NIST standard for key encapsulation. It replaces RSA and Diffie-Hellman (DH)/Elliptic Curve DH (ECDH) key exchange algorithms.

The purpose of ML-KEM is establishing a shared secret key over a public channel, and one of the most common places to see it is TLS handshakes. ML-KEM has three standardized parameter sets, with ML-KEM-768 recommended for general purpose use and TLS compatibility.

ML-DSA (FIPS 204)

ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is one of several standardized post-quantum digital signature schemes. It replaces digital signature algorithms, such as RSA signatures, and ECDSA/EdDSA.

ML-DSA is based on lattice-based cryptography and is currently the most efficient, standardized post-quantum digital signature algorithm. It offers three security levels and is recommended for general purpose use.

SLH-DSA (FIPS 205)

SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) is the other currently standardized post-quantum digital signature algorithm. It is a backup choice for replacing RSA signatures and ECDSA/EdDSA if ML-DSA is not a workable option.

SLH-DSA uses hash-based digital signatures, which offer stronger security guarantees than lattice-based cryptography. It supports both the SHA-2 and SHAKE signature families and offers variants with small signatures or fast signing.

Quick Decision Guide

If you're implementing post-quantum key exchange, the choice is easy. ML-KEM is the only option.

For digital signatures, things are more complicated. The following table lays out when you should use each algorithm.

A third signature scheme, FN-DSA, is currently in draft status. Since it offers smaller signatures and faster signing than ML-DSA, it should be considered once the standard is published.

Making the Move to Post-Quantum

Harvest-now, decrypt-later attacks and the complexity of a post-quantum migration make it critical for organizations to start the transition today. Choosing the right algorithm for each use case is important for compatibility, performance, and security. Download the NIST PQC Cheat Sheet as a handy reference for available algorithms and their use cases.