NIST PQC Standardization

NIST issued its call for proposals in December 2016 and accepted 69 complete submissions into round 1 in late 2017. Public cryptanalysis thinned the field: 26 candidates advanced to round 2 in January 2019, and on July 22, 2020 NIST named 7 finalists plus 8 alternates for round 3. On July 5, 2022 it announced the first algorithms to be standardized (CRYSTALS-Kyber for key establishment and CRYSTALS-Dilithium, Falcon, and SPHINCS+ for signatures) while sending four KEMs (BIKE, Classic McEliece, HQC, SIKE) into a fourth round.

The finalized standards followed on August 13, 2024, with the algorithms renamed to their FIPS identities: ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). On March 11, 2025 NIST concluded round 4 by selecting HQC as a fifth algorithm; a draft HQC standard is expected for public comment with finalization targeted for 2027.

Rather than quoting bit-security numbers, NIST's call for proposals defined five security categories pegged to the effort of attacking existing symmetric primitives. Categories 1, 3, and 5 require that breaking the scheme be at least as hard as key search on AES-128, AES-192, and AES-256 respectively; categories 2 and 4 are pegged to collision search on SHA-256 and SHA-384. Parameter sets are named against these targets: ML-KEM-768 is a category 3 parameter set, ML-DSA-87 a category 5 one.

The categories matter operationally because policy hooks into them: CNSA 2.0, for example, mandates category 5 parameters (ML-KEM-1024, ML-DSA-87) for national security systems, while most commercial TLS deployments settle on category 3.

All of NIST's primary selections except SLH-DSA are lattice-based, which concentrates risk: a mathematical breakthrough against structured lattices would take out ML-KEM, ML-DSA, and FN-DSA together. NIST hedged deliberately. SLH-DSA rests only on hash-function security, HQC was chosen precisely because its code-based construction shares no assumptions with ML-KEM, and the additional-signatures on-ramp explicitly prioritizes non-lattice schemes.

The competition itself demonstrated why diversity is not paranoia. Rainbow, a multivariate round-3 finalist, was broken by classical cryptanalysis in early 2022. SIKE, an isogeny-based KEM, advanced to round 4 in July 2022 and was broken weeks later by the Castryck-Decru attack, again on a classical computer. Both survived years of scrutiny before falling, which is the strongest available argument for standardizing algorithms from independent mathematical families.

Three work streams remain open. FIPS 206 will standardize FN-DSA (Falcon), a compact lattice signature whose floating-point implementation subtleties have made drafting slower than its siblings. The HQC standard is being drafted following the March 2025 selection, with finalization targeted for 2027. And the additional digital signatures on-ramp (a September 2022 call that drew 40 round-1 candidates) narrowed to 14 candidates in October 2024 and to 9 on May 14, 2026 (including UOV, MAYO, SQIsign, HAWK, and FAEST), with roughly two more years of evaluation expected.

For planning purposes, none of this changes the migration target: NIST is explicit that ML-KEM remains the recommended choice for general encryption and that the newer selections are backups and specialization, not replacements. Waiting for the portfolio to be 'done' is not a strategy. The finalized 2024 standards are the baseline now.