Last reviewed 10 November 2026
Algorithms
Three NIST standards name the post-quantum algorithms most organisations meet first. Each standard has a different job in real systems.
ML-KEM, in FIPS 203, is for key establishment. ML-DSA, in FIPS 204, is for digital signatures. SLH-DSA, in FIPS 205, is also for digital signatures, using a hash-based design with a different profile from ML-DSA.
A key-encapsulation mechanism, or KEM, is a way for two parties to establish a shared secret across an open network. One party runs encapsulation with the other's public key and produces ciphertext plus that shared secret; the other party decapsulates with the private key and recovers the same secret. Protocols such as TLS often use that secret to derive symmetric keys that protect the bulk of the traffic, in the same pattern as earlier public-key key establishment.
Post-quantum public keys and signatures are often larger than those from RSA or elliptic-curve cryptography. Processing can cost more CPU time or memory on constrained devices. Certificates, handshake messages, and firmware images therefore need more space and more testing before deployment. Those qualitative size and performance trade-offs are why teams treat deployment as an engineering exercise rather than a drop-in library swap.
Next: In real systems.
Sources
- NIST IR 8547, Transition to Post-Quantum Cryptography Standards, October 2026. NIST IR 8547
- NIST, FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism. FIPS 203
- NIST, FIPS 204, Module-Lattice-Based Digital Signature Algorithm. FIPS 204
- NIST, FIPS 205, Stateless Hash-Based Digital Signature Algorithm. FIPS 205