NIST PQC Standards Explained: ML-KEM, ML-DSA, and SLH-DSA
NIST finalised its first post-quantum cryptography standards in 2024. Here is what ML-KEM, ML-DSA, and SLH-DSA are, what they replace, and what organisations need to know about deploying them.
In August 2024, NIST published its first finalised post-quantum cryptography standards: FIPS 203 (ML-KEM, based on CRYSTALS-Kyber), FIPS 204 (ML-DSA, based on CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, based on SPHINCS+). These standards mark the beginning of the formal transition away from classical public-key cryptography.
ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) is the primary standard for key establishment. It replaces RSA and elliptic-curve Diffie-Hellman (ECDH) in protocols like TLS, SSH, and IPsec. ML-KEM operates on structured lattice problems that are believed to be resistant to both classical and quantum attacks.
ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is the primary standard for digital signatures. It replaces RSA signatures and ECDSA in certificate authorities, code signing, document signing, and authentication protocols. Like ML-KEM, it is based on the hardness of lattice problems.
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) provides a hash-based alternative for digital signatures. It is more conservative than ML-DSA — its security relies only on the properties of hash functions, which are well-understood — but it produces larger signatures and is slower. It is recommended as a backup or for high-assurance contexts.
For most organisations, the migration path involves replacing RSA and ECC with ML-KEM for key exchange and ML-DSA for signatures. The practical challenges are not algorithmic — they are operational. Certificate authorities must issue PQC certificates. TLS libraries must be updated. HSMs must support the new algorithms. PKI hierarchies must be rebuilt. These changes take years to plan and execute, which is why migration planning must begin now.
NIST has also recommended hybrid approaches during the transition period: combining classical and post-quantum algorithms so that security is maintained even if one algorithm is later found to be vulnerable. Hybrid TLS and hybrid certificates are already supported in several major implementations and are the recommended approach for high-value connections during the migration window.