Post-quantum cryptography: the NIST standards and how migration works

How NIST’s first post-quantum standards fit together, why migration must start before Q-Day, and the practical steps organizations face now.

Post-quantum cryptography is the effort to replace today’s vulnerable public-key cryptography with alternatives believed to resist attacks from future quantum computers. NIST’s first three finalized standards, released in 2024, mean the transition has moved from research into deployment: organizations are now expected to inventory where exposed algorithms are used, decide what to replace first, and begin multi-year migration work.

Why post-quantum cryptography is needed

The problem is not that quantum computers can break everything. The main concern is narrower and more important: widely used public-key systems depend on mathematical problems such as integer factorization, discrete logarithms, and elliptic-curve discrete logarithms. A sufficiently capable quantum computer running Shor’s algorithm could solve those problems efficiently, which would undermine systems such as RSA, finite-field Diffie–Hellman, and elliptic-curve Diffie–Hellman.

That threat is still prospective. As of 2026, quantum computers do not have the processing power to break widely deployed cryptographic systems, and laboratory demonstrations of Shor’s algorithm have only worked on very small numbers. The practical obstacle is not theoretical possibility but engineering scale: Wikipedia notes that outperforming classical methods may require machines with millions of qubits because of error-correction overhead.

Even so, waiting for a fully capable quantum computer would be a mistake. Migration takes years, and some data has a long confidentiality lifetime. That is why “harvest now, decrypt later” has become a central planning concept. An adversary can collect encrypted traffic or stored ciphertext today and keep it until future advances make decryption possible. For email archives, health data, intellectual property, government records, or critical infrastructure logs, the damage can arrive long after the data was first intercepted.

What quantum changes — and what it does not

A common misunderstanding is that quantum computing makes all cryptography obsolete.

Most current symmetric cryptography and hash functions are considered relatively secure against quantum attacks. Grover’s algorithm can speed up brute-force search against symmetric ciphers, but that effect can be offset in practice by using larger key sizes, such as doubling the key size. So the biggest disruption is in public-key cryptography, especially:

key establishment and key exchange
public-key encryption and key encapsulation
digital signatures

That is why NIST’s PQC program has focused on key encapsulation mechanisms, or KEMs, and digital signature algorithms, rather than replacing everything in the stack at once.

What NIST standardized first

NIST launched its formal standardization effort in late 2016 after a call for proposals. According to the standardization record, 69 complete and proper submissions entered the first round, and seven candidates reached the third round announced in July 2020. After years of evaluation, NIST finalized its first three standards on August 13, 2024.

Those standards are:

FIPS 203: ML-KEM, the Module-Lattice-Based Key-Encapsulation Mechanism, based on CRYSTALS-Kyber
FIPS 204: ML-DSA, the Module-Lattice-Based Digital Signature Algorithm, based on CRYSTALS-Dilithium
FIPS 205: SLH-DSA, the Stateless Hash-Based Digital Signature Algorithm, based on SPHINCS+

NIST describes ML-KEM as the primary standard for general encryption, highlighting its relatively small encryption keys and speed. ML-DSA is the primary standard for digital signatures. SLH-DSA uses a different mathematical basis and is intended as a backup in case ML-DSA later proves vulnerable.

NIST’s own guidance is explicit: these three standards are ready for immediate use and organizations should begin applying them now.

Why there are multiple standards, not one winner

The post-quantum field does not have a single dominant mathematical foundation. Different families have different strengths, implementation characteristics, and risk profiles. NIST’s choices reflect a portfolio mindset.

Lattice-based cryptography currently carries much of the deployment load. NIST’s first standardized lattice-based algorithms are ML-KEM and ML-DSA. They are attractive in part because of performance and manageable key sizes.

But diversification matters. NIST selected SLH-DSA, a hash-based signature scheme, as a backup to the primary lattice-based signature. Then, on March 11, 2025, NIST selected HQC as a backup KEM for general encryption. HQC is code-based, not lattice-based, and NIST said that difference in mathematical approach is the reason to keep it as a fallback.

The message is strategic: don’t bet the future of digital trust on one assumption alone.

The next standards in the pipeline

NIST’s PQC work did not end with the 2024 release.

The CSRC project page says NIST continues standardization work on:

Falcon, a digital signature algorithm
HQC, a key encapsulation mechanism

The standardization record says the Falcon-based standard will be called FN-DSA in FIPS 206. As of mid-2026, it remained in draft status. The cited reason for the slower timeline is implementation complexity: FN-DSA relies on floating-point Gaussian sampling in the signing process, which NIST says is harder to implement safely and in constant time than the three already-finalized standards.

For HQC, NIST said in March 2025 that a draft standard was expected in about a year, with a final standard expected in 2027 after public comment.

That staggered schedule matters operationally. Organizations do not need to wait for every future option before acting. NIST expects ML-KEM, ML-DSA, and SLH-DSA to form the basis for most deployments, and says they should already be used.

A quick map of the first standards

Standard	Algorithm name	Main job	Math family	NIST role description
FIPS 203	ML-KEM	Key establishment / general encryption support	Lattice-based	Primary standard for general encryption
FIPS 204	ML-DSA	Digital signatures	Lattice-based	Primary standard for signatures
FIPS 205	SLH-DSA	Digital signatures	Hash-based	Backup signature method
Forthcoming	FN-DSA	Digital signatures	NTRU-lattice-based	Additional signature standard under development
Forthcoming	HQC	Key establishment / general encryption support	Code-based	Backup KEM for ML-KEM

How migration actually works

Migration is less about swapping a library and more about redesigning cryptographic dependencies across systems.

NIST’s migration guidance says organizations need to identify where vulnerable algorithms are used and plan updates or replacements for products, services, and protocols. That means finding cryptography in places where it is often poorly documented:

TLS termination and internal service-to-service links
VPNs and remote access systems
PKI and certificate workflows
code signing and document signing
hardware security modules and firmware update systems
identity, access, and key management tools
embedded devices and operational technology
long-lived stored data protected under old key-establishment schemes

The first step is usually cryptographic inventory: where are RSA, Diffie–Hellman, or elliptic-curve mechanisms used, directly or through third-party products? The second is prioritization: which systems are high risk because they handle long-lived secrets or are hard to upgrade? The third is execution: testing, interoperability work, staged rollout, and policy changes.

NIST’s timeline raises the urgency. Under the transition timeline referenced on the CSRC page, NIST plans to deprecate and eventually remove quantum-vulnerable algorithms from its standards by 2035, with higher-risk systems moving much earlier.

The biggest engineering trade-offs

Post-quantum migration is not just a compliance exercise. It involves real technical compromises.

One broad trade-off is size versus efficiency. NIST’s PQC materials note that many PQC algorithms use larger keys than pre-quantum public-key systems. They also describe trade-offs among key size, computational efficiency, and ciphertext or signature size. For internet-facing protocols and constrained devices, these differences can affect bandwidth, latency, memory, and implementation complexity.

Another trade-off is maturity versus diversity. Lattice-based systems currently dominate the first standards because they performed well enough across NIST’s evaluations to become the primary choices. But concentration risk is real, which is why backup standards based on other math are being developed.

Implementation security is a third issue. The standardization record mentions side-channel concerns for Falcon and notes that possible mitigations can affect performance. More generally, a cryptographic design can look strong on paper while still being difficult to implement safely in practice.

What the standards do not settle

The existence of a standard does not prove everlasting security. Post-quantum algorithms are believed, not proven, to resist quantum attack. That caveat is built into the field itself.

There are also lessons from the NIST process. Some candidates were broken during evaluation. Wikipedia highlights two especially visible examples: Rainbow was broken on a classical computer during round three, and SIKE was broken in round four. Those failures do not invalidate PQC as a whole; they show why public cryptanalysis and conservative standardization take time.

Open questions remain around:

long-term confidence in the chosen mathematical problems
implementation quality across vendors and open-source stacks
side-channel resistance in real hardware and software
interoperability in protocols and certificate ecosystems
how aggressively organizations should diversify across algorithm families

A practical way to think about “when to move”

For most organizations, the right framing is not “Is Q-Day next year?” but “How long will our migration take, and how long must our data remain safe?”

If your systems are deeply embedded, regulated, globally distributed, or dependent on vendors, the transition may be slow. If your data would still be sensitive years from now, harvest-now risk makes delay more expensive. That logic explains why NIST is urging immediate adoption of the 2024 standards even though quantum computers have not yet reached the needed scale.

In short, PQC migration is a classic infrastructure transition: start before the emergency, because once the emergency is obvious, it is too late to move smoothly.

Key takeaways

Post-quantum cryptography is mainly about replacing vulnerable public-key systems, not discarding all existing cryptography.
A sufficiently capable quantum computer running Shor’s algorithm could break RSA, Diffie–Hellman, and elliptic-curve Diffie–Hellman.
NIST finalized its first three PQC standards on August 13, 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).
NIST says these standards are ready now and organizations should begin migration immediately.
ML-KEM is the primary standard for general encryption-related key establishment; ML-DSA is the primary signature standard; SLH-DSA is a backup signature method.
In March 2025, NIST selected HQC as a backup KEM based on different mathematics from ML-KEM.
Migration starts with discovering where vulnerable algorithms are used, then prioritizing high-risk systems and planning phased replacement.
Important trade-offs include larger key material, performance and bandwidth costs, implementation complexity, and the value of mathematical diversity.
PQC standards reduce future risk, but they do not eliminate uncertainty; continued cryptanalysis, implementation review, and operational testing remain essential.
The core urgency comes from long transition times and the possibility of harvest now, decrypt later attacks against data that must remain confidential for years.