NIST post-quantum cryptography standardisation
NIST's public process to select quantum-resistant public-key algorithms, opened with a call for proposals in December 2016. It produced FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in August 2024. Falcon (FN-DSA) and HQC were also selected for standardisation. Round-3 and round-4 KEMs that were not selected are listed for reference.
- Organiser
- NIST, Gaithersburg
- Region
- United States
- Stage
- FN-DSA and HQC standards
- Signatures
- 3 schemes
- KEMs
- 7 schemes
Timeline
Call for proposals
Submissions closed
Round 1: 69 candidates
Round 2: 26 candidates
Round 3: 7 finalists, 8 alternates
First selections and round 4: 4 selected, 4 KEMs to round 4
FIPS 203, 204 and 205 published
HQC selected
FN-DSA and HQC standards: in progress
Current
Security levels
NIST defines five security categories by comparison with attacks on AES and SHA-2/SHA-3. Each parameter set claims a category. This site shows each scheme on its own programme's scale and does not convert between scales.
| Category | At least as hard to break as |
|---|---|
| 1 | Key search on AES-128 |
| 2 | Collision search on SHA-256 / SHA3-256 |
| 3 | Key search on AES-192 |
| 4 | Collision search on SHA-384 / SHA3-384 |
| 5 | Key search on AES-256 |
Standards and candidates
pk size vs. sig size (log–log scale)
Scroll to zoom · drag to pan· tap a point for details
| Programmes | Assumption | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Falcon | Lattices | Std pending | 1024 | 5 | 1,793 | 1,280 | 3,073 | 1.03 ms | 23.4 µs | NTRU-SIS |
| Falcon | Lattices | Std pending | 512 | 1 | 897 | 666 | 1,563 | 490.8 µs | 13.5 µs | NTRU-SIS |
| ML-DSA | Lattices | FIPS 204 | ML-DSA-87 | 5 | 2,592 | 4,627 | 7,219 | 93.1 µs | 52.0 µs | MLWE/MSIS |
| ML-DSA | Lattices | FIPS 204 | ML-DSA-65 | 3 | 1,952 | 3,309 | 5,261 | 73.3 µs | 33.5 µs | MLWE/MSIS |
| ML-DSA | Lattices | FIPS 204 | ML-DSA-44 | 2 | 1,312 | 2,420 | 3,732 | 50.2 µs | 20.9 µs | MLWE/MSIS |
| SLH-DSA | Symmetric | FIPS 205 | SHAKE-192s | 3 | 48 | 16,224 | 16,272 | 1.02 s | 842.4 µs | Hash-based |
| SLH-DSA | Symmetric | FIPS 205 | SHAKE-256s | 5 | 64 | 29,792 | 29,856 | 922.57 ms | 1.25 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS 205 | SHAKE-128s | 1 | 32 | 7,856 | 7,888 | 576.41 ms | 575.6 µs | Hash-based |
| SLH-DSA | Symmetric | FIPS 205 | SHAKE-256f | 5 | 64 | 49,856 | 49,920 | 94.58 ms | 2.49 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS 205 | SHAKE-192f | 3 | 48 | 35,664 | 35,712 | 43.56 ms | 2.32 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS 205 | SHAKE-128f | 1 | 32 | 17,088 | 17,120 | 26.55 ms | 1.58 ms | Hash-based |