Last updated 2026-07-07. On August 13, 2024, NIST finalized the world's first post-quantum cryptography standards — the reference point every vendor listed in this directory is now building against. This guide breaks down what each standard actually does, in plain language, without the marketing gloss.
Why this exists
Classical public-key cryptography (RSA, Diffie-Hellman, elliptic curve) relies on math problems that are hard for ordinary computers but that a sufficiently large quantum computer could solve efficiently, using Shor's algorithm. No quantum computer capable of that exists yet at the scale needed to break real-world keys — but data encrypted today can be harvested now and decrypted later once one does ("harvest now, decrypt later"). That risk is why the migration timeline matters even before a capable quantum computer exists.
The three finalized standards
| Standard | Algorithm | Purpose |
|---|---|---|
| FIPS 203 | ML-KEM (formerly CRYSTALS-Kyber) | Key encapsulation / encryption — the primary standard for establishing a shared secret over an insecure channel |
| FIPS 204 | ML-DSA (formerly CRYSTALS-Dilithium) | Digital signatures — the primary standard for signing and verifying |
| FIPS 205 | SLH-DSA (formerly SPHINCS+) | Digital signatures — a conservative backup built on hash functions rather than lattice math, in case ML-DSA is ever broken |
FIPS 203 — ML-KEM
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is what most organizations will touch first, since it replaces the key-exchange step in TLS — the handshake that sets up an encrypted connection. It's based on lattice-based cryptography, chosen over competing approaches for its balance of small key sizes and fast performance. Real-world deployment is already underway: Google Chrome enabled a hybrid X25519+ML-KEM key exchange by default starting in Chrome 131 (November 2024), and Cloudflare has been running post-quantum TLS in production across its network.
FIPS 204 — ML-DSA
ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is the primary standard for signatures — the mechanism that proves a message or certificate came from who it claims to. It's also lattice-based, sharing some of the same underlying math family as ML-KEM.
FIPS 205 — SLH-DSA
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) takes a deliberately different mathematical approach — hash-based rather than lattice-based. NIST standardized it specifically as a hedge: if a future cryptanalytic breakthrough ever weakens lattice-based schemes, an unrelated approach is already standardized and ready to fall back on.
Migration deadlines
A June 2026 federal executive order set concrete deadlines for federal civilian high-value systems: 2030 for key-establishment migration and 2031 for digital-signature migration. Organizations that sell into government or regulated industries should treat these as real planning dates, not distant hypotheticals — crypto migrations at organizational scale routinely take years.
Where to start
- Inventory first. You can't migrate what you haven't found — cryptographic asset inventory (certificates, libraries, hardcoded algorithm choices) is almost always the actual bottleneck, not the cryptography itself.
- Prioritize by data lifetime. Data that needs to stay confidential for 10+ years is at "harvest now, decrypt later" risk today, regardless of when a capable quantum computer arrives.
- Use hybrid modes where available. Pairing a classical algorithm with a post-quantum one (as Chrome and Cloudflare do) hedges against undiscovered weaknesses in the newer math without giving up today's proven security.
Compare vendors already shipping ML-KEM, ML-DSA, and SLH-DSA support — hardware, libraries, and managed migration services.
Browse the PQC Directory →