NIST Releases First 3 Finalized Post-Quantum Cryptography Standards

The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has completed its primary set of encryption algorithms designed to defend against potential cyberattacks by quantum computers.

Globally, researchers are striving to develop quantum computers, which would function in fundamentally different ways than traditional computers, potentially compromising the current encryption systems that safeguard our online activities. The algorithms announced today represent the first fully developed standards from NIST’s post-quantum cryptography (PQC) standardization initiative and are now ready for implementation.

These three newly established standards are designed with the future in mind. Quantum computing technology is advancing swiftly, with some experts suggesting that within a decade, we could see devices capable of breaking today’s encryption methods, posing risks to individual, organizational, and national security.

“Quantum computing’s progress is crucial to maintaining America’s position as a global tech leader and securing our economic future,” stated Deputy Secretary of Commerce Don Graves. “The Department of Commerce is committed to ensuring the U.S. remains competitive in quantum technology, with NIST playing a pivotal role. NIST’s expertise is key in developing innovative solutions to quantum challenges, including post-quantum cryptography, which organizations can begin to implement to protect our future. As this decade-long effort continues, we look forward to upholding our leadership in this critical area.”

The finalized standards—comprising the encryption algorithms’ code, implementation instructions, and intended applications—are the culmination of an eight-year project led by NIST, which has a longstanding history in encryption development. The agency has engaged global cryptography experts to create, submit, and evaluate algorithms capable of withstanding quantum computer attacks. While quantum technology holds the promise of revolutionizing fields like weather forecasting, fundamental physics, and drug discovery, it also presents significant security threats.

“Quantum computing could potentially address many of society’s most difficult problems, but it also brings security challenges. These new standards reflect NIST’s dedication to ensuring that quantum advancements do not compromise our security,” said Laurie E. Locascio, Under Secretary of Commerce for Standards and Technology and NIST Director. “These finalized standards are the pinnacle of NIST’s efforts to protect our confidential electronic information.”

Encryption is a cornerstone of our digital society, safeguarding countless secrets—from emails and medical records to national security data. Encrypted information can be transmitted over public networks, remaining inaccessible to all but its intended recipients. Current encryption methods rely on complex mathematical problems that are difficult or impossible for conventional computers to solve. However, a sufficiently advanced quantum computer could quickly crack these codes. The algorithms NIST has standardized are based on new mathematical problems that are challenging for both traditional and quantum computers.

“These standards include detailed instructions for integrating them into products and encryption systems,” said NIST mathematician Dustin Moody, who leads the PQC standardization project. “We encourage system administrators to begin incorporating them now, as full integration will take time.”

Moody also noted that these standards are the primary tools for general encryption and digital signature protection.

NIST continues to assess two additional sets of algorithms that might serve as backup standards in the future.

One of these sets includes three algorithms designed for general encryption, based on different mathematical problems than the main algorithm in the finalized standards. NIST plans to announce its selection of one or two of these algorithms by the end of 2024.

The second set focuses on a larger group of algorithms for digital signatures. In response to new ideas from cryptographers since the initial 2016 call for submissions, NIST requested additional algorithms in 2022 and has begun evaluating them. Soon, NIST expects to announce approximately 15 algorithms from this group that will advance to the next phase of testing, evaluation, and analysis.

While these additional sets are still under review, Moody emphasized that any subsequent PQC standards would act as backups to the three standards announced today.

“There’s no need to wait for future standards,” he said. “Start using these three now. We must be ready in case these algorithms are compromised, and we will continue developing backup plans to ensure our data remains secure. But for most applications, these new standards are the main focus.”

The New Standards & Document Links

Encryption is crucial for protecting sensitive electronic information, such as secure websites and emails. Public-key encryption systems, which rely on math problems that are difficult for computers to solve, are widely used to ensure that websites and messages remain secure from unauthorized access. In developing these new standards, NIST evaluated not only the security of the underlying math but also the best applications for each algorithm.

The new standards address two critical encryption tasks: general encryption, which protects information exchanged over public networks, and digital signatures, used for identity authentication. In 2022, NIST selected four algorithms—CRYSTALS-Kyber, CRYSTALS-Dilithium, Sphincs+, and FALCON—for standardization. Three draft standards based on these algorithms were released in 2023, with the fourth expected in late 2024.

Although there have been no significant changes to the standards since the draft versions, NIST has updated the algorithms’ names to reflect the versions in the finalized standards:

• Federal Information Processing Standard (FIPS) 203 is the primary standard for general encryption, based on the CRYSTALS-Kyber algorithm, now named ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). It is known for its small encryption keys and operational speed.
• FIPS 204 is the primary standard for digital signatures, using the CRYSTALS-Dilithium algorithm, renamed ML-DSA (Module-Lattice-Based Digital Signature Algorithm).
• FIPS 205 is another digital signature standard, employing the Sphincs+ algorithm, now called SLH-DSA (Stateless Hash-Based Digital Signature Algorithm). This standard uses a different mathematical approach and serves as a backup to ML-DSA.

The upcoming FIPS 206 standard, based on the FALCON algorithm, will be named FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm).