What are the NIST post-quantum cryptography standards ML-KEM, ML-DSA, and SLH-DSA?
NIST finalized three post-quantum cryptography standards in August 2024. ML-KEM (FIPS 203) is the primary key encapsulation mechanism, replacing RSA and ECDH in protocols such as TLS. ML-DSA (FIPS 204) is the primary digital signature algorithm, replacing ECDSA and RSA signatures in code signing, PKI, and general authentication. SLH-DSA (FIPS 205) is a conservative hash-based backup signature scheme suited for long-term roots of trust and firmware signing where algorithm diversity is valued.
ML-KEM (FIPS 203): Post-Quantum Key Establishment
ML-KEM, standardized as NIST FIPS 203 in August 2024, is the primary post-quantum key encapsulation mechanism. It is based on the hardness of Module Learning With Errors lattice problems, which are believed to resist both classical and quantum attacks. ML-KEM replaces RSA and ECDH for key establishment in TLS 1.3, VPNs, SSH, and encrypted messaging. It is typically deployed in hybrid mode alongside classical ECDH so both mechanisms must be broken simultaneously to compromise session keys. Three parameter sets are defined: ML-KEM-512, ML-KEM-768, and ML-KEM-1024, corresponding to NIST security levels 1, 3, and 5.
ML-DSA (FIPS 204): Post-Quantum Digital Signatures
ML-DSA, standardized as NIST FIPS 204 in August 2024, is the primary post-quantum digital signature algorithm. Built on Module-LWE and Module-SIS lattice problems, it supports code signing, PKI certificate issuance, software update authentication, and general-purpose authentication across NIST security levels 2, 3, and 5. ML-DSA-65 (level 3) is the recommended parameter set for most production deployments. It replaces ECDSA and RSA signatures throughout public key infrastructure and offers strong performance characteristics suitable for high-throughput production environments.
SLH-DSA (FIPS 205): Hash-Based Backup Signatures
SLH-DSA, standardized as NIST FIPS 205 in August 2024, is a stateless hash-based signature scheme. Its security reduces entirely to the collision resistance of the underlying hash function, making it mathematically independent of the lattice-based assumptions underpinning ML-KEM and ML-DSA. This independence provides algorithm diversity: a weakness in lattice cryptography would not affect SLH-DSA's security. It is preferred for root certificate authorities, firmware signing, and long-term archival contexts where conservative security assumptions outweigh the larger signature and key sizes relative to ML-DSA.
Algorithm comparison
A side-by-side look at the standardized primitives so you can match the right algorithm to each workload.
ML-KEM
Structured Lattices · PKE / KEM
Basis: Module Learning With Errors (lattices)
Public Key
1,184 B
ML-KEM-768
Ciphertext
1,088 B
ML-KEM-768
NIST Levels
1 · 3 · 5
Security strength
Best for: Key exchange, TLS 1.3, VPN, hybrid encryption
ML-DSA
Structured Lattices · Signature
Basis: Module-LWE and Module-SIS (lattices)
Public Key
1,952 B
ML-DSA-65
Signature
3,309 B
ML-DSA-65
NIST Levels
2 · 3 · 5
Security strength
Best for: Code signing, PKI certificates, general signatures
FALCON (FN-DSA)
Structured Lattices · Signature
Basis: NTRU lattices (short integer solution)
Public Key
897 B
FALCON-512
Signature
666 B
FALCON-512
NIST Levels
1 · 5
Security strength
Best for: Compact signatures, constrained and embedded devices
SLH-DSA (SPHINCS+)
Hash-Based · Signature
Basis: Stateless hash-based (hash functions only)
Public Key
32 B
SLH-DSA-128s
Signature
7,856 B
SLH-DSA-128s
NIST Levels
1 · 3 · 5
Security strength
Best for: Conservative root-of-trust, firmware signing, long-term archives
Key and output sizes are shown for the indicated parameter set and vary across security levels.
The NIST-standardized algorithms, by family
Three mathematical families structured lattices, hash-based, and code-based span the standardized primary algorithms and their backups.
Structured Lattices NIST Finalized
ML-KEM
The primary NIST-standardized key encapsulation mechanism (FIPS 203), based on Module Learning With Errors. The standard for post-quantum key establishment in TLS, VPNs, and file encryption. Deployed in hybrid mode alongside classical key exchange both must be broken to compromise any session.
ML-DSA
The primary NIST-standardized digital signature standard (FIPS 204). Powers code signing, PKI certificates, document signatures, and API authentication at security levels 2, 3, and 5. Fast signing and verification make it the right choice for high-throughput applications.
FALCON (FN-DSA)
A compact lattice-based signature scheme selected by NIST for standardization as FN-DSA (FIPS 206, pending finalization). Offers the smallest signatures among lattice-based candidates ideal for constrained devices and bandwidth-sensitive applications. Available in Quantumize today.
NTRU
One of the oldest and most studied lattice-based cryptographic schemes. NTRU-based key encapsulation provides an alternative lattice hardness assumption to ML-KEM, adding mathematical diversity to hybrid deployment architectures. Round 4 candidate badge as such in compliance documentation.
SABER
A Module Learning With Rounding (MLWR) key encapsulation mechanism offering fast operations and compact parameters. SABER's rounding-based design avoids Gaussian sampling, simplifying constant-time implementation. Round 4 candidate providing architectural diversity alongside ML-KEM.
FrodoKEM
A conservative lattice-based KEM based on plain (unstructured) Learning With Errors. FrodoKEM trades performance for the most cautious security assumptions among lattice schemes recommended for ultra-sensitive, long-lived data where maximum conservatism is required. Round 4 candidate.
Hash-Based NIST Finalized
SLH-DSA (SPHINCS+)
A NIST-standardized backup signature standard (FIPS 205) built entirely on hash functions no lattice assumptions required. Security reduces to the hardness of the underlying hash function alone. The conservative choice for root-of-trust certificates, firmware signing, and long-lived records requiring multi-decade security assurance.
Code-Based NIST Selected
HQC
A code-based KEM selected by NIST as the backup to ML-KEM. Security rests on decoding random linear error-correcting codes a fundamentally different mathematical family from lattices. HQC ensures that if lattice-based assumptions are ever weakened, organizations running HQC in hybrid mode remain protected.
Classic McEliece
The most conservatively designed post-quantum KEM, based on the hardness of decoding Goppa codes a problem unsolved for over 40 years. Classic McEliece's security track record is unmatched among PQC candidates. Large key sizes (hundreds of KB) make it best suited for long-term key encapsulation rather than interactive protocols. Round 4 candidate.
Classical vs. Post-Quantum Algorithms
RSA and elliptic-curve algorithms are broken by Shor's algorithm on a sufficiently large quantum computer (P. W. Shor, 1994). The NIST-standardized replacements run on today's infrastructure and are interoperable with existing deployment patterns via hybrid mode.
| Purpose | Classical (Vulnerable) | Post-Quantum Replacement | NIST Standard |
|---|---|---|---|
| Key establishment | RSA-2048 / ECDH P-256 | ML-KEM-768 | FIPS 203 (Aug 2024) |
| Digital signatures | ECDSA P-256 / RSA-2048 | ML-DSA-65 | FIPS 204 (Aug 2024) |
| Long-lived / backup signatures | RSA-2048 | SLH-DSA-128s | FIPS 205 (Aug 2024) |
Sources: NIST FIPS 203, 204, 205 (August 2024). Vulnerability of RSA and ECDH/ECDSA to quantum attack: P. W. Shor, "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer," SIAM Review, 1999.
Frequently Asked Questions
When should I use ML-DSA versus SLH-DSA for digital signatures?
ML-DSA (FIPS 204) is the primary recommendation for most digital signature use cases: code signing, PKI certificates, and general-purpose authentication. SLH-DSA (FIPS 205) is preferred when conservative, long-term security assurance is the priority root certificates, firmware signing, and scenarios where algorithm diversity matters. SLH-DSA's security depends only on hash functions, providing a different hardness assumption from lattice-based schemes.
How do post-quantum key and signature sizes compare to RSA and ECDSA?
Post-quantum algorithms have larger keys and signatures than classical equivalents. ML-KEM-768 has a 1,184-byte public key and 1,088-byte ciphertext, compared to 32 bytes for an ECDH P-256 public key. ML-DSA-65 produces 3,309-byte signatures compared to 64 bytes for ECDSA P-256. These differences affect TLS handshake sizes, certificate chain lengths, and storage requirements and must be planned for during migration.
Should I deploy ML-KEM and ML-DSA now, or wait for additional NIST standards?
NIST, CISA, and NSA all recommend beginning migration now using the finalized standards: ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). Waiting does not address the harvest-now-decrypt-later risk that exists today. Deploying in hybrid mode alongside classical algorithms provides immediate protection while additional standards such as FN-DSA (FALCON, FIPS 206) are finalized.
What does NIST Security Level 3 mean in practice?
NIST Security Level 3 is defined as providing security roughly equivalent to AES-192 against both classical and quantum attacks. For most enterprise deployments, Level 3 is a strong balance of security and performance: ML-KEM-768 and ML-DSA-65 both target Level 3. Organizations protecting very long-lived or highly sensitive data may prefer Level 5 parameter sets.
Last reviewed: