Category: Cryptography & Encryption
FIPS 203/204/205
Also known as: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), Post-Quantum Cryptography FIPS, PQC Standards
Simply put
FIPS 203, 204, and 205 are the first three finalized federal standards from NIST for post-quantum cryptography, designed to protect data against future attacks by powerful quantum computers. FIPS 203 covers a method for securely establishing shared encryption keys, while FIPS 204 and 205 each specify digital signature schemes used to authenticate data and detect unauthorized changes. NIST published these standards in August 2024, with an effective date of August 14, 2024.
Formal definition
FIPS 203, 204, and 205 are Federal Information Processing Standards issued by NIST specifying quantum-resistant cryptographic algorithms, effective August 14, 2024. FIPS 203 specifies the Module-Lattice-based Key-Encapsulation Mechanism (ML-KEM), a key-establishment mechanism used to securely negotiate a shared secret key between parties, it is a key-encapsulation mechanism, not a general-purpose or symmetric encryption standard. FIPS 204 specifies the Module-Lattice-based Digital Signature Algorithm (ML-DSA), and FIPS 205 specifies the Stateless Hash-based Digital Signature Algorithm (SLH-DSA); both provide digital signature schemes used to detect unauthorized modifications to data and to authenticate the originator. These standards are maintained by NIST; practitioners should note that this entry does not cover implementation validation, migration timelines, or agency-specific adoption requirements, which must be confirmed against the current authoritative NIST publications and any applicable transition guidance.
Why it matters
FIPS 203, 204, and 205 represent NIST's first finalized federal standards for post-quantum cryptography, addressing a threat that most current public-key cryptography was not designed to withstand: the eventual arrival of cryptographically relevant quantum computers capable of breaking widely used key-establishment and digital signature schemes. For defense and public sector organizations, these standards matter because sensitive data with long confidentiality lifespans may be vulnerable to "harvest now, decrypt later" strategies, in which an adversary collects encrypted traffic today with the intent of decrypting it once quantum capability matures. Finalizing these standards gives agencies and contractors an authoritative, NIST-issued foundation on which to plan cryptographic transitions.
Who it's relevant to
Information System Security Managers and System Owners
ISSMs and system owners responsible for federal information systems will need to understand where key establishment (potentially served by ML-KEM under FIPS 203) and digital signatures (ML-DSA under FIPS 204 or SLH-DSA under FIPS 205) are used within their environments. Because these standards became effective August 14, 2024, they form a reference point for planning cryptographic modernization, though specific migration deadlines and validation requirements must be verified against current NIST and agency guidance rather than assumed from the effective date alone.
Compliance Officers and Auditors
Compliance personnel should recognize FIPS 203, 204, and 205 as NIST-issued Federal Information Processing Standards, and should avoid conflating them with encryption controls broadly. In particular, FIPS 203's ML-KEM is a key-encapsulation mechanism for key establishment, not a symmetric or general-purpose encryption standard, a distinction that matters when mapping these standards to control requirements. This entry does not cover how or when these standards become mandatory for a given system, which depends on applicable authoritative transition guidance.
Government Contractors and Product Vendors
Contractors and vendors supplying cryptographic products or services to defense and civilian agencies should track these finalized PQC standards, as future procurement and authorization expectations may reference them. Validation of implementations and any agency-specific adoption requirements are out of scope here and should be confirmed against current NIST publications and cryptographic module validation processes.
Inside FIPS 203/204/205
FIPS 203 (ML-KEM)
Specifies the Module-Lattice-based Key-Encapsulation Mechanism (ML-KEM), derived from the CRYSTALS-Kyber submission. It is a key-encapsulation mechanism used for establishing a shared secret key between parties, not a general-purpose encryption or symmetric-cipher standard. It supports quantum-resistant key establishment.
FIPS 204 (ML-DSA)
Specifies the Module-Lattice-based Digital Signature Algorithm (ML-DSA), derived from the CRYSTALS-Dilithium submission. It provides quantum-resistant digital signatures for authentication and integrity purposes.
FIPS 205 (SLH-DSA)
Specifies the Stateless Hash-based Digital Signature Algorithm (SLH-DSA), derived from the SPHINCS+ submission. It provides an alternative quantum-resistant digital signature approach based on hash functions rather than lattices.
Post-Quantum Cryptography (PQC) standard set
These represent the first set of finalized PQC standards issued by NIST, published in August 2024 with an effective date of August 14, 2024. They are intended to provide algorithms designed to resist attacks from cryptographically relevant quantum computers.
Issuing authority
These Federal Information Processing Standards are issued and maintained by NIST. Practitioners should verify current text, revisions, and any implementation guidance against the authoritative NIST publications, as tailoring and agency-specific adoption timelines may differ.
Common questions
Answers to the questions practitioners most commonly ask about FIPS 203/204/205.
Is FIPS 203 a general-purpose encryption standard I can use to encrypt data at rest or in transit?
No. FIPS 203 specifies the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), which is used for key establishment rather than for directly encrypting data. A key-encapsulation mechanism lets two parties establish a shared secret key that can then be used with a separate symmetric algorithm for bulk encryption. Treating FIPS 203 as a standalone encryption or symmetric-cipher standard is a common mistake; it addresses the key-establishment portion of a cryptographic protocol, and you should confirm the current authoritative text at csrc.nist.gov for precise applicability.
Are FIPS 204 and FIPS 205 just alternative encryption standards similar to FIPS 203?
No. FIPS 204 and FIPS 205 specify digital signature schemes, not key establishment or encryption. FIPS 204 defines the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) and FIPS 205 defines the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA). These serve authentication and integrity purposes and are distinct in function from the key-encapsulation role of ML-KEM in FIPS 203. Selecting among them depends on whether the use case requires key establishment or digital signatures, which you should verify against the applicable published standard.
When were these standards published and effective, and what does that mean for planning?
These standards were published in August 2024 with an effective date of August 14, 2024, and represent the first three post-quantum cryptography (PQC) FIPS publications from NIST. An effective date generally establishes when a standard is available for use and reference, but it does not by itself dictate a mandatory migration deadline for any given system; agency- and program-specific timelines may differ. Readers should confirm current migration guidance and any applicable deadlines against official NIST and agency sources rather than assuming the publication date equals a compliance cutoff.
Which standard should I use for establishing a shared session key versus signing data?
For key establishment, FIPS 203 (ML-KEM) is the relevant standard, because a key-encapsulation mechanism is designed to establish a shared secret. For digital signatures, FIPS 204 (ML-DSA) or FIPS 205 (SLH-DSA) apply. In most implementations these functions are combined within a broader protocol, where ML-KEM handles the key exchange and a signature algorithm handles authentication. Verify the intended function of each algorithm against the applicable published FIPS text before selecting one for a specific control or protocol requirement.
How do these PQC standards fit into an existing cryptographic module validation approach?
These standards specify algorithms; they do not by themselves constitute a validated cryptographic module. In most implementations, using an approved algorithm is only part of meeting module validation expectations, which generally involve separate testing and validation processes. Adopting ML-KEM, ML-DSA, or SLH-DSA does not automatically mean a module is validated. This entry does not cover validation program specifics, and readers should confirm current requirements and testing pathways against the applicable official NIST program guidance.
Does adopting FIPS 203, 204, or 205 make my system quantum-resistant on its own?
Not necessarily. Implementing a post-quantum algorithm addresses one component of a system's cryptography, but overall resistance depends on how the algorithm is integrated, whether legacy algorithms remain in use, and how key management and protocols are configured. Compliance with a standard is not equivalent to comprehensive security, and many systems may operate in hybrid configurations during migration. This entry does not address implementation, contractual, or migration specifics, which should be confirmed against current authoritative sources.
Common misconceptions
FIPS 203 (ML-KEM) is a general encryption or symmetric-cipher standard that replaces AES.
FIPS 203 specifies a key-encapsulation mechanism (ML-KEM) used to establish a shared secret key between parties. It is not a general-purpose encryption standard and does not replace symmetric ciphers such as AES; in most implementations the established key is subsequently used with a separate symmetric algorithm.
Publishing these FIPS means agencies must immediately rip and replace all existing cryptography.
While these standards have a stated effective date, adoption in practice generally follows migration planning, cryptographic inventory, and agency-specific tailoring. Practitioners should confirm applicable timelines and transition guidance against current NIST and agency sources rather than assuming an instantaneous mandate.
The three standards are interchangeable and any one can be used for any cryptographic function.
They serve distinct purposes: FIPS 203 (ML-KEM) is for key establishment, while FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) are for digital signatures. ML-DSA and SLH-DSA rest on different mathematical foundations (lattice-based versus hash-based) and are not simply substitutes for one another.
Best practices
Select the correct standard for the intended cryptographic function: use FIPS 203 (ML-KEM) for key establishment and FIPS 204 (ML-DSA) or FIPS 205 (SLH-DSA) for digital signatures, and do not treat ML-KEM as a general encryption standard.
Verify the current authoritative NIST publication text, revision status, and any implementation guidance before designing or asserting compliance, as details may be updated after initial publication.
Develop a cryptographic inventory and migration plan rather than assuming an immediate, wholesale replacement of existing algorithms tied to the effective date.
Where signatures are required, evaluate both the lattice-based (ML-DSA) and hash-based (SLH-DSA) options against your threat model and performance constraints instead of defaulting to one.
Confirm how these standards map to your applicable authorization framework (for example DoD RMF or civilian FISMA obligations), since adoption timelines and tailoring may differ across environments.
Coordinate with authorizing officials and validation programs to confirm that any deployed implementations meet the required validation and configuration expectations for your system.