On 13 August 2024, the US National Institute of Standards and Technology (NIST) published three new standards: FIPS 203, FIPS 204 and FIPS 205. They are the first official encryption methods designed to stay secure even against large quantum computers.
We call the moment when today’s encryption stops being safe the “cryptographic cliff”. These standards are the bridge that lets us cross it safely. This article explains them in plain language.
Why we needed new standards
Most online security, from the padlock in your browser to banking apps and software updates, depends on two families of maths: RSA and elliptic-curve cryptography (ECC). They are safe today because ordinary computers would need an impossibly long time to solve the maths problems behind them.
In 1994, mathematician Peter Shor showed that a large enough quantum computer could solve those problems quickly. No such machine exists yet, but replacing encryption across the world takes many years, so NIST started a public competition in 2016 to find replacements.
Eight years of public testing
NIST received 82 candidate algorithms from teams in 25 countries. Over several rounds, cryptographers around the world tried to break them. Some candidates fell along the way: in 2022, researchers broke SIKE using a single ordinary computer core in about an hour, and another candidate, Rainbow, was broken over a weekend on a laptop.
Those failures show the process worked. The algorithms that survived had been attacked in public for years before being standardised.
The three new standards
| Standard | Name | Original name | What it does |
|---|---|---|---|
| FIPS 203 | ML-KEM | CRYSTALS-Kyber | Lets two parties agree on a secret key over the internet (key exchange). |
| FIPS 204 | ML-DSA | CRYSTALS-Dilithium | Creates digital signatures that prove who sent something and that it wasn’t changed. |
| FIPS 205 | SLH-DSA | SPHINCS+ | A back-up signature method built only on hash functions, a very well-understood kind of maths. |
ML-KEM and ML-DSA are based on lattices: grids of points in hundreds of dimensions. Finding certain short paths through such a grid appears to be hard for both ordinary and quantum computers. SLH-DSA uses only hash functions, so if lattices were ever weakened, it would still stand.
What changes in practice
For most people, nothing visible changes: websites, apps and messages look the same. Under the hood, the new keys and signatures are larger than the ones they replace. An ML-KEM-768 public key is 1,184 bytes, compared with 32 bytes for the widely used X25519 method. ML-KEM is also very fast, so size is usually the main cost.
- ◆Key exchange: ML-KEM is already used alongside classical methods in web browsers, messaging apps and remote-login tools.
- ◆Signatures: ML-DSA signatures are about 2.4 to 4.6 kilobytes, much larger than today’s 64-byte elliptic-curve signatures. This matters for certificates and small devices.
- ◆More to come: NIST is preparing FN-DSA (based on the Falcon algorithm), which has smaller signatures. In March 2025 it also selected HQC as a back-up key-exchange method built on different maths.
What organisations should do now
The standards are final, so there is no reason to wait. The first step is to find out where your organisation uses RSA and ECC today, then plan upgrades, starting with data that must stay secret the longest. NIST has proposed deprecating today’s quantum-vulnerable algorithms after 2030 and disallowing them after 2035.
task_altKey takeaways
- check_circleNIST published FIPS 203, 204 and 205 on 13 August 2024.
- check_circleML-KEM protects key exchange; ML-DSA and SLH-DSA protect digital signatures.
- check_circleThe new algorithms survived eight years of public attempts to break them.
- check_circleKeys and signatures are bigger, but performance is generally good.