The post-quantum toolkit
What quantum-safe means, and the NIST standards
NIST's first three finalized post-quantum standards, what each replaces, and the two items still in progress.
6 min read
What you'll be able to do
- Define quantum-safe (or post-quantum) cryptography precisely.
- Name FIPS 203, 204, and 205, what each is used for, and the earlier project each came from.
- State the current status of HQC and FN-DSA, and why a backup algorithm built on different math matters.
Quantum-safe (also called post-quantum) cryptography means a cryptographic algorithm believed to resist both classical and quantum attack, including Shor's algorithm — typically because its security rests on a mathematical problem with no known efficient quantum algorithm against it. It does not mean quantum-powered, or that it uses quantum mechanics; post-quantum algorithms run on ordinary classical computers.
On 13 August 2024, NIST published its first three finalized post-quantum standards, following an open, multi-year public competition and review process.
| Standard | Algorithm | Came from | Type |
|---|---|---|---|
| FIPS 203 | ML-KEM | CRYSTALS-Kyber | Key-encapsulation mechanism (KEM) |
| FIPS 204 | ML-DSA | CRYSTALS-Dilithium | Digital signature |
| FIPS 205 | SLH-DSA | SPHINCS+ | Digital signature |
Two more items are in progress, not finished. In March 2025, NIST selected HQC as a backup KEM, deliberately built on different (code-based) mathematics than ML-KEM's lattice-based foundation, as a hedge in case a future weakness were found in lattice-based schemes; its standard is still being drafted. A FALCON-based signature standard, planned as FN-DSA, is drafted but not yet final.
Marking a lesson complete only updates this browser.