NIST PQC Standards: ML-KEM, ML-DSA, and SLH-DSA Explained
· Technical · 8 min read
The new standards
In August 2024, NIST published three post-quantum cryptographic standards that will replace the RSA and ECC algorithms we've relied on for decades. These aren't optional upgrades - they're the foundation of cryptographic security for the quantum era.
Here's what each one does, in plain language.
ML-KEM (FIPS 203) - Key Encapsulation
Replaces: RSA key exchange, ECDH key agreement
What it does: ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) allows two parties to securely agree on a shared secret key over an insecure channel. This is the mechanism that protects your TLS handshakes, VPN tunnels, and any system that establishes encrypted connections.
Three security levels:
| Variant | Security Level | Key Size | Use Case |
|---|---|---|---|
| ML-KEM-512 | NIST Level 1 | ~800 bytes | General web traffic |
| ML-KEM-768 | NIST Level 3 | ~1,184 bytes | Enterprise, financial |
| ML-KEM-1024 | NIST Level 5 | ~1,568 bytes | Government, defense |
Deploy first because: Key exchange is the #1 target for HNDL attacks. Protecting key exchange with ML-KEM immediately stops adversaries from decrypting future traffic, even if they intercept it.
Current adoption:
- Chrome and Firefox support X25519Kyber768 (hybrid) since 2024
- Cloudflare has deployed ML-KEM on all edge servers
- AWS and Azure offer PQC-enabled TLS in preview
ML-DSA (FIPS 204) - Digital Signatures
Replaces: RSA signatures, ECDSA signatures
What it does: ML-DSA (Module-Lattice-Based Digital Signature Algorithm) provides quantum-resistant digital signatures. This protects certificate validation, code signing, document signing, and any system that verifies authenticity and integrity.
Three security levels:
| Variant | Security Level | Signature Size | Use Case |
|---|---|---|---|
| ML-DSA-44 | NIST Level 2 | ~2,420 bytes | General purpose |
| ML-DSA-65 | NIST Level 3 | ~3,309 bytes | Enterprise PKI |
| ML-DSA-87 | NIST Level 5 | ~4,627 bytes | Government, long-term |
Note on signature sizes: ML-DSA signatures are significantly larger than ECDSA signatures (64 bytes). This impacts certificate chain sizes and TLS handshake performance. Plan for increased bandwidth in your migration.
Deploy second because: While HNDL attacks target key exchange (deploy ML-KEM first), signature forgery requires a quantum computer in real-time - which is a slightly less immediate threat than stored-traffic decryption.
SLH-DSA (FIPS 205) - Stateless Hash-Based Signatures
Replaces: RSA signatures (high-security applications)
What it does: SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) is a conservative, hash-based signature scheme. It's slower and produces larger signatures than ML-DSA, but its security relies only on the well-understood security of hash functions - no lattice assumptions needed.
When to use it:
- Root CA certificates - Where signature verification speed doesn't matter
- Firmware signing - Where long-term trust is critical
- Air-gapped systems - Where conservative security assumptions are preferred
Most organizations won't deploy SLH-DSA widely. It's a specialized tool for maximum-security applications where ML-DSA's lattice-based security assumptions feel too new.
Migration priority
For most enterprises, the deployment order is:
- ML-KEM (key exchange) - Stops HNDL attacks immediately
- ML-DSA (signatures) - Quantum-proofs your PKI and code signing
- SLH-DSA (conservative signatures) - For root CAs and high-security assets
Hybrid mode: the bridge
During the transition, deploy hybrid cryptography - combine classical algorithms with PQC algorithms:
- `X25519 + ML-KEM-768` for key exchange
- `ECDSA P-256 + ML-DSA-65` for signatures
Hybrid mode ensures you're protected against quantum attacks while maintaining backward compatibility with systems that don't yet support PQC.
Qypher automatically detects which algorithms you're using and recommends the correct PQC replacement for each. Get your assessment →