NIST’s replacements for the public-key cryptography a quantum computer could break, and how to read each one.
| Standard | Status | Job | Replaces | Examples where used | How to read it |
|---|---|---|---|---|---|
| FIPS 203ML-KEM from CRYSTALS-Kyber |
FinalAugust 2024 | Key establishment: agreeing the secret key that encrypts the data | RSA key transport, Diffie-Hellman, ECDH | Hybrid TLS 1.3 key exchange (X25519MLKEM768) in Chrome, Edge, Firefox and Cloudflare; OpenSSH’s default key exchange; VPNs and IPsec; messaging apps such as Signal and iMessage | The urgent one. It stops harvest now, decrypt later and maps to the executive order’s December 31, 2030 deadline. Default parameter set: ML-KEM-768 (national security systems use ML-KEM-1024). |
| FIPS 204ML-DSA from CRYSTALS-Dilithium |
FinalAugust 2024 | Digital signatures, the general-purpose choice | RSA, ECDSA and EdDSA signatures | TLS certificates and PKI; code and document signing; authentication; Cloudflare’s post-quantum origin authentication; ML-DSA-87 for national security systems under CNSA 2.0 | The default for authentication. It maps to the December 31, 2031 signature deadline. Signatures are larger than today’s, so test performance in TLS and constrained systems. |
| FIPS 205SLH-DSA from SPHINCS+ |
FinalAugust 2024 | Hash-based signatures, the conservative backup | RSA, ECDSA and EdDSA where long-term trust matters | Firmware and secure-boot signing; root certificate authorities; long-lived signatures; Arc’s opt-in post-quantum wallet signature | Choose it where trust must last decades. Its security rests only on hash functions, but signatures are much larger and slower than ML-DSA’s. |
| FIPS 206FN-DSA from Falcon |
DraftFinal expected late 2026 or early 2027 | Compact digital signatures | RSA and ECDSA where signature size matters | Planned for certificate chains, bandwidth-constrained devices and blockchains; lab testing only until final | Watch, don’t deploy. It has the smallest signatures but is harder to implement safely. Wait for the final standard and HSM support. |
Symmetric encryption and hashing stay. ML-KEM protects the delivery of AES keys rather than replacing AES. NIST says all AES key sizes remain acceptable; CNSA 2.0 requires AES-256 for national security systems.
It validates the products that implement these algorithms. When buying, ask for FIPS 203 and 204 support in a FIPS 140-3 validated module, with a dated roadmap if validation is pending.
Executive Order 14412: federal key establishment by December 31, 2030; signatures by December 31, 2031. NIST IR 8547: RSA and ECC deprecated after 2030, disallowed after 2035.
Sources: NIST FIPS 203, 204 and 205 and IR 8547; Executive Order 14412; Cloudflare blog; Arc documentation; industry reporting on FIPS 206 status. Signal and iMessage use Kyber-based protocols, the predecessor of ML-KEM. Checked November 5, 2026.