NIST PQC Standardization

What NIST PQC standardization means

Post-quantum cryptography, or PQC, addresses public-key cryptographic methods that could be threatened if large-scale, cryptanalytically relevant quantum computers are realized. The cited FIPS context identifies integer-factorization and discrete-logarithm-based public-key systems—including systems based on finite fields and elliptic curves—as examples of public-key cryptosystems whose security could be at risk. NIST’s response was a public process to select quantum-resistant public-key algorithms for standardization, rather than a private designation of a single vendor’s technology.12

The word standardization is important. A selected algorithm is a candidate that NIST has chosen to take forward for standard development or related work. A final FIPS publication is a completed federal information processing standard with a specified algorithm and publication status. An implementation is the software, firmware, hardware, or combination that uses the standard. These are distinct stages: selection does not automatically make an implementation conforming, validated, interoperable, or securely deployed.36

From public call to evaluation rounds

NIST initiated the public PQC standardization process in 2016. The FIPS 203, FIPS 204, and FIPS 205 context passages state that 82 candidate algorithms were submitted for consideration and that NIST selected the first four algorithms for standardization after three rounds of evaluation and analysis. A separate NIST overview passage describes an earlier stage in which 69 candidate algorithms cleared the submission bar and were released for public analysis. These figures describe different points or summaries in the cited evidence; this article does not collapse them into one count.124

The process was intentionally open and transparent. The cited overview says that cryptographers around the world were invited to analyze and attempt to break candidate algorithms, and that multiple rounds reduced the candidate set. It also says NIST encouraged analysis across different environments, including large computers, smartphones, constrained devices, smart cards, Internet of Things devices, and microchips. This breadth matters because a candidate’s practical suitability cannot be judged only in one hardware or software setting.5

1. Public process initiated in 2016.
2. Candidate algorithms submitted against NIST’s requirements.
3. Candidates made available for public cryptanalysis and technical analysis.
4. Multiple evaluation rounds reduced the field and informed selections.
5. Selected algorithms were specified in final standards or advanced through additional standardization work.
6. Organizations then address implementation, validation, inventory, interoperability, and migration tasks.

The three final standards published on August 13, 2024

On August 13, 2024, NIST published the first three final PQC standards as Federal Information Processing Standards. The cited NIST project material identifies them as FIPS 203, FIPS 204, and FIPS 205. The individual FIPS evidence records each show a publication date and effective date of August 13, 2024. The standards specify one key-encapsulation mechanism and two digital-signature standards.342

FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, specifies ML-KEM. The FIPS 203 context says ML-KEM is a variant of the selected CRYSTALS-Kyber algorithm and is a lattice-based KEM based on the Module Learning With Errors assumption. For this article’s scope, the central point is functional: FIPS 203 is the initial final NIST standard for the PQC key-establishment role.17

FIPS 204, Module-Lattice-Based Digital Signature Standard, specifies ML-DSA. Its context identifies ML-DSA as derived from the selected CRYSTALS-Dilithium scheme and describes it as intended to protect sensitive U.S. government information well into the foreseeable future, including after the advent of cryptographically relevant quantum computers. FIPS 204 therefore occupies the digital-signature role, not the KEM role.23

FIPS 205, Stateless Hash-Based Digital Signature Standard, specifies SLH-DSA. The standard’s abstract says digital signatures detect unauthorized data modification and authenticate the signatory’s identity; it identifies SLH-DSA as based on SPHINCS+, which was selected for standardization through the NIST PQC process. FIPS 205 is the second initial final digital-signature standard.4

Selected algorithms, final standards, and additional-candidate work

The terms “selected” and “standardized” should not be treated as interchangeable. The initial process selected four algorithms for standardization after three rounds, while the first three final FIPS publications specify ML-KEM, ML-DSA, and SLH-DSA. The cited project material separately states that Falcon and HQC were selected for ongoing standardization and that this work was underway. A separate NIST transition draft says the fourth round was evaluating additional KEM algorithms and that NIST anticipated selecting one or more alternatives to ML-KEM in the future.36

HQC is therefore not presented here as one of the three initial final FIPS standards: the cited RFC passage explicitly says that HQC had been selected as part of the NIST PQC project but had not yet been standardized. The same passage says NIST had named FN-DSA and assigned it FIPS 206, but that the specification had not yet been released at the time of that document’s publication. Because status can change over time, each statement must be read with its source’s date and status rather than as a timeless inventory.6

Implementation validation is separate from publication

The final FIPS publications describe implementations as capable of existing in software, firmware, hardware, or combinations of those forms. They also state that NIST will develop a validation program to test implementations for conformance to the algorithms in the standards. A conforming implementation may use a mathematically equivalent computational procedure instead of reproducing every specified procedural step, provided it produces the correct output for every input. This flexibility does not eliminate the need for conformance testing or secure engineering.124

The implementation qualifications are explicit. FIPS 203 states that the security guarantees of a KEM hold only under specified conditions, including secrecy of values such as the randomness used by the parties, the decapsulation key, and the shared secret key. It also states that conformance does not ensure that a particular implementation is secure; the implementer remains responsible for designing and building a module securely. FIPS 204 and FIPS 205 similarly address protection of signature private keys and the use of approved cryptographic algorithms or techniques.1

For KEM implementations, the cited NIST SP 800-227 evidence says implementations must comply with the specific FIPS or SP that specifies the relevant KEM; it gives ML-KEM and FIPS 203 as the example. It also describes additional requirements concerning parameter sets, keys, ciphertexts, shared secret keys, FIPS 140-3 guidance, and approved components. These requirements illustrate why “the algorithm was standardized” is not equivalent to “the organization has deployed a conforming and secure cryptographic module.”124

Migration guidance and what organizations still need to do

NIST’s project material says organizations should begin migrating to quantum-resistant cryptography with the release of the first three final PQC standards. It identifies practical work: update cybersecurity products, services, and protocols; identify where vulnerable algorithms are used; and plan to replace or update them. The NIST IR 8547 initial public draft is intended to inform federal agencies, technology providers, standards organizations, and CMVP laboratories about migration efforts and timelines. Because that document is explicitly an initial public draft published in November 2024, its proposals should be distinguished from the final FIPS standards.

The same project material says NIST expects ML-KEM, ML-DSA, and SLH-DSA to provide the foundation for most PQC deployments and says they can and should be put into use now. It also says NIST continues evaluating innovative algorithms for additional standardization, including backup algorithms and algorithms for unique use cases. Migration should therefore be treated as an ongoing program of inventory, prioritization, engineering, testing, validation, rollout, and future algorithm agility—not as a one-time event completed by selecting a standard.3

The project material reports a transition timeline in NIST IR 8547 under which NIST will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems transitioning much earlier. The cited IR is identified in the source set as an initial public draft published November 12, 2024. Accordingly, the 2035 statement should be attributed to that draft’s transition timeline and dated as such, rather than presented as an undated universal deadline.

• Create an inventory of public-key algorithms and the systems, protocols, products, and services in which they are used.
• Classify uses by confidentiality, integrity, authentication, sensitivity, system lifetime, and operational risk.
• Map each use to the relevant function: ML-KEM for the key-establishment role, or ML-DSA and SLH-DSA for digital-signature roles.
• Test implementations and dependencies, including parameter handling, key protection, interoperability, performance, and module-validation requirements where applicable.
• Plan staged replacement or updates while retaining the ability to respond to future standardization and algorithm developments.

Limits of what the standards establish

The three FIPS publications establish standardized specifications and immediate effective dates; they do not certify every product that implements them. The FIPS evidence expressly places responsibility for secure implementation on the implementer and describes validation as a program for testing conformance. Product security, operational key management, secure integration, protocol compatibility, and system-level risk remain separate questions.421

Nor does NIST’s initial set mean that PQC standardization is finished. The cited project material describes ongoing work on Falcon and HQC, additional KEM evaluation, and longer-term solicitation of additional digital-signature schemes that could serve as backups or address unique use cases. Status must therefore be reported with a date and the relevant document status: final FIPS standards, ongoing standardization work, and draft migration guidance are different categories of evidence.36

Conclusion

NIST PQC standardization was an open, multi-year process that began in 2016, used public analysis and multiple evaluation rounds, and produced three initial final standards on August 13, 2024: FIPS 203 for ML-KEM, FIPS 204 for ML-DSA, and FIPS 205 for SLH-DSA. The process continues beyond those publications through additional-candidate work. For organizations, publication is a starting point: migration requires cryptographic inventory, function-appropriate selection, secure implementation, applicable validation, testing, and staged operational replacement.1234