The post-quantum toolkit
What quantum-safe means, and the NIST standards
NIST's first three finalized post-quantum standards, what each replaces, and the two items still in progress.
7 min read · 7 min 3 sec film
What you'll be able to do
- Define quantum-safe (or post-quantum) cryptography precisely.
- Name FIPS 203, 204, and 205, what each is used for, and the earlier project each came from.
- State the current status of HQC and FN-DSA, and why a backup algorithm built on different math matters.
Lesson film
Watch: What quantum-safe means, and the NIST standards
Three finalised standards, two still in progress, and one distinction — KEM or signature — that a migration plan cannot get wrong.
7 min 3 sec · 9 scenes
7 min 3 sec, narrated by your browser's voice. Captions and a full transcript are below — nothing here needs sound.
Module one established what breaks. Module two is about what replaces it, starting with the vocabulary.
With the player focused: Space plays or pauses, ← → seek ten seconds, Home restarts, M toggles narration.
Full transcript
1. What the words mean
2. It is not quantum technology
3. How the standards arrived
4. The three standards
5. What a KEM does
6. Two different jobs
7. Both, not either
8. In progress means in progress
9. Takeaway
The written lesson
Quantum-safe (also called post-quantum) cryptography means a cryptographic algorithm believed to resist both classical and quantum attack, including Shor's algorithm — typically because its security rests on a mathematical problem with no known efficient quantum algorithm against it. It does not mean quantum-powered, or that it uses quantum mechanics; post-quantum algorithms run on ordinary classical computers.
On 13 August 2024, NIST published its first three finalized post-quantum standards, following an open, multi-year public competition and review process.
| Standard | Algorithm | Came from | Type |
|---|---|---|---|
| FIPS 203 | ML-KEM | CRYSTALS-Kyber | Key-encapsulation mechanism (KEM) |
| FIPS 204 | ML-DSA | CRYSTALS-Dilithium | Digital signature |
| FIPS 205 | SLH-DSA | SPHINCS+ | Digital signature |
Two more items are in progress, not finalized standards. In March 2025, NIST selected HQC for standardization as a backup KEM, using code-based mathematics rather than ML-KEM's lattice-based foundation. The FALCON-based FN-DSA signature standard remains under development. Selection and work on a standard do not make either a published final FIPS; check NIST's current publication list before treating either as such.
- 01
Generate
The recipient creates an ML-KEM encapsulation key and a corresponding decapsulation key. The public encapsulation key can be shared; the decapsulation key stays private.
- 02
Encapsulate
The sender uses the public key to create a ciphertext and a shared secret. The sender transmits the ciphertext, not the shared secret.
- 03
Decapsulate
The recipient uses the private key and ciphertext to derive the same shared secret. A protocol derives traffic keys and authenticates peers through additional steps.
Primary reading and claim sources
Publication status checked on the date shown. Draft guidance can change.
- FIPS 203: Module-Lattice-Based Key-Encapsulation MechanismNIST · Final standard · Sections 3.1 and 8; Table 3 (parameter sizes) · checked 2026-09-26
- FIPS 204: Module-Lattice-Based Digital Signature StandardNIST · Final standard · Table 2 (key and signature sizes) · checked 2026-09-26
- FIPS 205: Stateless Hash-Based Digital Signature StandardNIST · Final standard · checked 2026-09-26
- Selected Algorithms for StandardizationNIST · Current project status · checked 2026-09-26
Marking a lesson complete only updates this browser.