NIST FIPS 203, 204 & 205 Post-Quantum Algorithm Reference
On 13 August 2024, NIST published the first three finalised federal post-quantum cryptographic standards. Use the byte-budget matrix below to size TLS 1.3 handshake buffers, X.509 certificate chains, and HSM storage slots.
Parameter Sets, Security Categories & Wire Byte Sizes
| Standard | Parameter Set | NIST Security Level | Public Key | Ciphertext / Signature | Primary Production Role |
|---|---|---|---|---|---|
| FIPS 203 | ML-KEM-512 | Category 1 (AES-128 eq.) | 800 B | 768 B | Constrained IoT key encapsulation |
| FIPS 203 | ML-KEM-768 | Category 3 (AES-192 eq.) | 1,184 B | 1,088 B | Default commercial TLS 1.3 hybrid (X25519MLKEM768) & OpenSSH 9.9+ |
| FIPS 203 | ML-KEM-1024 | Category 5 (AES-256 eq.) | 1,568 B | 1,568 B | NSA CNSA 2.0 National Security Systems & sovereign secrets |
| FIPS 204 | ML-DSA-44 | Category 2 | 1,312 B | 2,420 B | High-throughput TLS/mTLS leaf authentication |
| FIPS 204 | ML-DSA-65 | Category 3 | 1,952 B | 3,309 B | General enterprise X.509 certificates & document signing |
| FIPS 204 | ML-DSA-87 | Category 5 | 2,592 B | 4,627 B | NSA CNSA 2.0 PKI roots, OS packages, and high-assurance code signing |
| FIPS 205 | SLH-DSA-SHA2-128s | Category 1 (Stateless Hash) | 32 B | 7,856 B | Long-lived root CAs and firmware verification independent of lattice assumptions |
| FIPS 205 | SLH-DSA-SHA2-256f | Category 5 (Stateless Hash) | 64 B | 49,856 B | Fast offline artifact signing where signature size is non-critical |
Technical Questions Answered
Why deploy X25519MLKEM768 for key exchange before rotating RSA/ECDSA TLS certificates to ML-DSA?+
Harvest-Now-Decrypt-Later (HNDL) attacks target confidentiality: an adversary recording TLS sessions today can decrypt them later if the key exchange was classical X25519. Authentication signatures only need to resist forgery at the moment of the handshake, whereas ML-DSA certificate chains add 7 KB to 15 KB to handshake payloads and require CA root program updates.
Why use a hybrid group (X25519 + ML-KEM-768) instead of standalone ML-KEM-768?+
Combining battle-tested elliptic-curve X25519 with lattice-based ML-KEM-768 guarantees that session confidentiality remains at least as strong as classical TLS 1.3 even if an unexpected flaw were ever found in module-lattice cryptography, while immediately blocking quantum Shor decryption.
Are AES-256 and SHA-384 broken by a quantum computer?+
No. Shor’s algorithm breaks public-key systems based on integer factorisation (RSA) and discrete logarithms (Diffie-Hellman, ECDH, ECDSA). Grover’s algorithm provides at most a quadratic speedup against symmetric ciphers, meaning AES-256 and SHA-384 retain high post-quantum security.
What did NIST rename Kyber, Dilithium, and SPHINCS+ to in the final August 2024 standards?+
In the final August 2024 publications, CRYSTALS-Kyber was standardised as ML-KEM (FIPS 203), CRYSTALS-Dilithium became ML-DSA (FIPS 204), and SPHINCS+ became SLH-DSA (FIPS 205), with minor domain-separation and seed-handling updates incompatible with pre-standard drafts.
Reviewed by Callum Reid, Principal Infrastructure & Cryptography Editor
Reviews post-quantum transport standards and PKI specifications.
Last reviewed:
Reviewed every 3 months
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Verified Primary Sources
- FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (NIST, August 2024)
- FIPS 204: Module-Lattice-Based Digital Signature Standard (NIST, August 2024)
- FIPS 205: Stateless Hash-Based Digital Signature Standard (NIST, August 2024)
Track FIPS & IETF TLS Working Group Revisions
PQC & Hybrid TLS Readiness BriefingsStore your email for concise engineering notes when IANA TLS codepoints or NIST SP 800-227 recommendations update. No emails are sent yet.