The NIST post-quantum cryptography standards, explained

The public-key cryptography that secures most of the internet — RSA and elliptic-curve — relies on math problems a large enough quantum computer could solve efficiently (via Shor’s algorithm). No such machine exists today, and timelines are genuinely uncertain, so this is a planning problem, not an emergency.

What makes it pressing is “harvest now, decrypt later”: an adversary can record encrypted data today and decrypt it once a capable quantum computer arrives. Anything that must stay confidential — or verifiable — for years should move to quantum-resistant algorithms well before then.

FIPS 203 — ML-KEM (from CRYSTALS-Kyber): a key-encapsulation mechanism for establishing shared secrets, i.e. the key exchange that sets up an encrypted channel.

FIPS 204 — ML-DSA (from CRYSTALS-Dilithium): a lattice-based digital signature scheme, the workhorse for signing. THRONDAR signs every answer with ML-DSA-87, its highest-strength (NIST security category 5) parameter set.

FIPS 205 — SLH-DSA (from SPHINCS+): a hash-based signature scheme. It’s larger and slower, but rests on a completely different (and very conservative) security assumption than the lattice schemes — useful as a diversity option.

NIST also selected Falcon, to be standardized as FN-DSA under FIPS 206. As of mid-2026 that standard is still in preparation — selected but not yet published. That’s an important honesty point: it’s correct to call Falcon “forthcoming,” and incorrect to call it a finalized NIST standard.

Falcon produces compact signatures, which is why systems use it as a second, independent signature alongside ML-DSA — but any product should describe it as draft/forthcoming, not certified.

Two practical patterns dominate. Hybrid: pair a classical algorithm (like X25519) with a post-quantum one (like ML-KEM-1024) during the transition, so you’re no worse off than today even if one is later weakened. Diversity: use more than one signature family (a lattice scheme plus a hash-based one) so a break in one doesn’t take down your whole provenance.

The first concrete step for most organizations isn’t swapping algorithms — it’s inventory. You can’t migrate what you can’t see, so you build a Cryptographic Bill of Materials (CBOM): a machine-readable list of every primitive you use, mapped to its standard and role.