[{"data":1,"prerenderedAt":800},["ShallowReactive",2],{"blog-\u002Fblog\u002Fnist-pqc-standards-guide":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":717,"date":718,"description":719,"draft":720,"extension":721,"faqs":722,"findingsSource":7,"geo":735,"howto":7,"howtoTitle":7,"image":7,"industries":737,"keyFindings":7,"meta":739,"modified":740,"navigation":741,"path":742,"pullquote":7,"recommendations":7,"references":743,"related":774,"seo":788,"seoTitle":789,"signposts":7,"slug":790,"stats":791,"stem":794,"tags":795,"tldr":798,"__hash__":799},"blog\u002Fblog\u002Fnist-pqc-standards-guide.md","NIST Post-Quantum Standards Guide: FIPS 203, 204, 205 and What Comes Next","ArcQubit Team",null,{"type":9,"value":10,"toc":697},"minimark",[11,16,29,33,145,149,158,170,182,186,198,202,210,214,220,226,235,239,254,259,263,293,297,362,366,385,388,417,420,424,427,471,475,509,513,516,587,591,594,623,627,681,685,688,694],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24,25,28],"p",{},"NIST has finalized three post-quantum standards: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA), a hash-based backup signature. Two more are pending: FN-DSA (FIPS 206), a compact signature scheme that NIST has not yet released as a public draft, and HQC, a backup key-encapsulation mechanism NIST selected in March 2025 ",[21,22,23],"span",{},"4",", ",[21,26,27],{},"5",".",[12,30,32],{"id":31},"status-at-a-glance-as-of-sep-30-2026","Status at a glance (as of Sep. 30, 2026)",[34,35,36,55],"table",{},[37,38,39],"thead",{},[40,41,42,46,49,52],"tr",{},[43,44,45],"th",{},"Standard",[43,47,48],{},"Algorithm",[43,50,51],{},"Function",[43,53,54],{},"Status",[56,57,58,76,92,108,124],"tbody",{},[40,59,60,64,67,70],{},[61,62,63],"td",{},"FIPS 203",[61,65,66],{},"ML-KEM",[61,68,69],{},"Key establishment",[61,71,72,73],{},"Final, Aug. 2024 ",[21,74,75],{},"1",[40,77,78,81,84,87],{},[61,79,80],{},"FIPS 204",[61,82,83],{},"ML-DSA",[61,85,86],{},"Digital signatures",[61,88,72,89],{},[21,90,91],{},"2",[40,93,94,97,100,103],{},[61,95,96],{},"FIPS 205",[61,98,99],{},"SLH-DSA",[61,101,102],{},"Digital signatures (hash-based)",[61,104,72,105],{},[21,106,107],{},"3",[40,109,110,113,116,119],{},[61,111,112],{},"FIPS 206",[61,114,115],{},"FN-DSA",[61,117,118],{},"Compact digital signatures",[61,120,121,122],{},"In development; no public draft yet, final date not announced ",[21,123,27],{},[40,125,126,129,132,135],{},[61,127,128],{},"To be assigned",[61,130,131],{},"HQC",[61,133,134],{},"Backup key encapsulation",[61,136,137,138,24,140,24,142],{},"Selected Mar. 2025; draft standard (FIPS 207) not yet public ",[21,139,23],{},[21,141,27],{},[21,143,144],{},"8",[12,146,148],{"id":147},"fips-203-ml-kem","FIPS 203: ML-KEM",[17,150,151,152,154,155,28],{},"ML-KEM is the module-lattice key-encapsulation mechanism NIST standardized for key establishment ",[21,153,75],{},". It replaces the key-exchange job that Diffie-Hellman, ECDH, and RSA key transport perform today ",[21,156,157],{},"6",[17,159,160,161,163,164,166,167,28],{},"OMB describes ML-KEM as efficient, with moderate key sizes and larger overhead than elliptic-curve cryptography ",[21,162,157],{},". FIPS 203 sets the sizes: an ML-KEM-768 encapsulation key takes 1,184 bytes and its ciphertext takes 1,088 bytes, while ML-KEM-1024 takes 1,568 bytes for both ",[21,165,75],{},". TLS 1.3 key shares carry these same values ",[21,168,169],{},"7",[17,171,172,173,175,176,181],{},"ML-KEM already runs on the internet through hybrid key exchange. RFC 10024, published in August 2026, defines three hybrid groups for TLS 1.3, including X25519MLKEM768 ",[21,174,169],{},". ",[177,178,180],"a",{"href":179},"\u002Fblog\u002Fhybrid-vs-pure-post-quantum","Hybrid vs. Pure Post-Quantum"," explains when to use hybrid.",[12,183,185],{"id":184},"fips-204-ml-dsa","FIPS 204: ML-DSA",[17,187,188,189,191,192,194,195,197],{},"ML-DSA is the module-lattice digital signature standard ",[21,190,91],{},". OMB calls it a balanced choice with a solid lattice foundation and warns that signature size can strain bandwidth in some uses ",[21,193,157],{},". FIPS 204 lists signatures of 2,420 bytes (ML-DSA-44), 3,309 bytes (ML-DSA-65) and 4,627 bytes (ML-DSA-87) ",[21,196,91],{},". That is larger than the rough 1 to 2 KB figure in the OMB memo, so size your protocols from the standard. Use ML-DSA as your default signature algorithm for certificates, code signing, and document signing.",[12,199,201],{"id":200},"fips-205-slh-dsa","FIPS 205: SLH-DSA",[17,203,204,205,207,208,28],{},"SLH-DSA is the stateless hash-based signature standard ",[21,206,107],{},". Its security rests on hash functions, not on lattices, so it works as a fallback if someone breaks a lattice assumption. The tradeoff is size and speed: OMB notes signatures in the tens of kilobytes and slower signing ",[21,209,157],{},[12,211,213],{"id":212},"fn-dsa-fips-206-compact-signatures-still-in-development","FN-DSA (FIPS 206): compact signatures, still in development",[17,215,216,217,219],{},"FN-DSA is the signature scheme based on the Falcon algorithm. It produces the smallest signatures of the lattice family, which suits bandwidth-limited settings. NIST's project page, last updated Aug. 5, 2026, lists FIPS 206 as in development ",[21,218,27],{},". As of Sep. 30, 2026, I found no public draft on NIST's site and no Federal Register notice, so no comment period has opened and NIST has announced no final date. Earlier secondary reports of a late 2026 or early 2027 final are estimates, not NIST commitments.",[17,221,222,223,28],{},"NSA's CNSA 2.0 FAQ states that for National Security Systems, \"ML-DSA is preferred, as FN-DSA seems more susceptible to implementation errors that may affect security\" ",[21,224,225],{},"9",[17,227,228,232,233,28],{},[229,230,231],"strong",{},"What to do:"," Do not deploy FN-DSA in production until NIST publishes the final standard. NSA says that any algorithm called CRYSTALS-Kyber or CRYSTALS-Dilithium that does not adhere to FIPS 203 or 204 is not CNSA 2.0 compliant ",[21,234,225],{},[12,236,238],{"id":237},"hqc-the-backup-key-encapsulation-mechanism","HQC: the backup key-encapsulation mechanism",[17,240,241,242,244,245,247,248,250,251,253],{},"On Mar. 11, 2025, NIST selected HQC as a backup to ML-KEM because it rests on a different mathematical approach ",[21,243,23],{},". NIST planned to release a draft standard for public comment in about a year, take comments for 90 days, and finalize in 2027 ",[21,246,23],{},". As of Sep. 30, 2026, NIST's project page still lists HQC as selected with standardization underway ",[21,249,27],{},", and I found no published draft. NIST has presented the forthcoming standard as FIPS 207 ",[21,252,144],{},". Treat 2027 as NIST's plan, not a commitment, and check NIST's post-quantum project page before you quote a status.",[17,255,256,258],{},[229,257,231],{}," Keep migrating to ML-KEM. HQC is a backup, not a replacement.",[12,260,262],{"id":261},"how-the-standards-fit-us-policy","How the standards fit U.S. policy",[264,265,266,275,283],"ul",{},[267,268,269,272,273,28],"li",{},[229,270,271],{},"Civilian agencies:"," OMB M-26-15 lists FIPS 203, 204, and 205 as the algorithms agencies adopt and notes that FALCON and HQC may follow ",[21,274,157],{},[267,276,277,280,281,28],{},[229,278,279],{},"National Security Systems:"," NSA's CNSA 2.0 suite selects specific parameter sets, including ML-KEM-1024 and ML-DSA-87, and states that non-conforming versions of the algorithms do not satisfy the requirement ",[21,282,225],{},[267,284,285,288,289,292],{},[229,286,287],{},"Validated modules:"," The June 2026 executive order tells NIST to speed up validation of cryptographic modules ",[21,290,291],{},"10",". Check the Cryptographic Module Validation Program status of any library you plan to use.",[12,294,296],{"id":295},"which-standard-for-which-job","Which standard for which job",[34,298,299,312],{},[37,300,301],{},[40,302,303,306,309],{},[43,304,305],{},"You need",[43,307,308],{},"Start with",[43,310,311],{},"Notes",[56,313,314,327,340,351],{},[40,315,316,319,322],{},[61,317,318],{},"Key exchange in TLS, VPNs, messaging",[61,320,321],{},"ML-KEM (FIPS 203), usually in a hybrid group",[61,323,324,325],{},"See ",[177,326,180],{"href":179},[40,328,329,332,335],{},[61,330,331],{},"General signatures: certificates, code signing",[61,333,334],{},"ML-DSA (FIPS 204)",[61,336,337,338],{},"Plan for signature sizes of 2.4 to 4.6 KB ",[21,339,91],{},[40,341,342,345,348],{},[61,343,344],{},"Long-lived roots of trust where you want a non-lattice fallback",[61,346,347],{},"SLH-DSA (FIPS 205)",[61,349,350],{},"Expect large signatures and slower signing",[40,352,353,356,359],{},[61,354,355],{},"Very tight bandwidth for signatures",[61,357,358],{},"Wait for FN-DSA (FIPS 206)",[61,360,361],{},"Not yet published as a draft",[12,363,365],{"id":364},"what-this-means-for-executives-and-the-board","What this means for executives and the board",[17,367,368,369,24,371,24,373,375,376,24,378,24,380,24,382,384],{},"You do not need to pick algorithms. You do need to know that the choice has narrowed. NIST finalized three standards in August 2024 ",[21,370,75],{},[21,372,91],{},[21,374,107],{},", and the finished set already covers key establishment and signatures ",[21,377,75],{},[21,379,91],{},[21,381,107],{},[21,383,23],{},". That gives your organization something concrete to buy, build and audit against.",[17,386,387],{},"Three points matter at the leadership level.",[264,389,390,398,407],{},[267,391,392,395,396,28],{},[229,393,394],{},"Confidentiality comes first."," The harvest-now, decrypt-later risk targets data in transit and in storage, so key establishment (ML-KEM) is the first job to fix ",[21,397,75],{},[267,399,400,403,404,406],{},[229,401,402],{},"Standards are not the same as compliance."," A library can implement FIPS 203 and still lack the module validation your regime requires ",[21,405,291],{},". Your CISO owns that check.",[267,408,409,412,413,24,415,28],{},[229,410,411],{},"Two standards are unfinished."," FN-DSA and HQC are pending, so do not make purchase commitments that depend on them ",[21,414,23],{},[21,416,27],{},[17,418,419],{},"ArcQubit guidance: treat this as an inventory and supplier question, not a science project. Your board should hear who owns the work, which systems come first, and which vendors have committed to the finished standards.",[12,421,423],{"id":422},"decisions-leadership-must-make-in-the-next-90-days","Decisions leadership must make in the next 90 days",[17,425,426],{},"These are our recommendations, not requirements from NIST.",[428,429,430,436,448,457,463],"ol",{},[267,431,432,435],{},[229,433,434],{},"Name one accountable owner."," Assign a single executive, usually the CISO, who reports progress on the standards to the board.",[267,437,438,441,442,24,444,24,446,28],{},[229,439,440],{},"Adopt the finished standards as your target."," Write ML-KEM, ML-DSA and SLH-DSA into your architecture policy as the approved algorithms ",[21,443,75],{},[21,445,91],{},[21,447,107],{},[267,449,450,453,454,456],{},[229,451,452],{},"Freeze pre-standard bets."," Tell teams not to deploy FN-DSA in production until NIST publishes the final standard ",[21,455,27],{},". Tell them to keep HQC on the watch list only.",[267,458,459,462],{},[229,460,461],{},"Put the standards into procurement."," Ask new suppliers which of the three standards their products support, and in what form (hybrid or standalone).",[267,464,465,468,469,28],{},[229,466,467],{},"Require validation evidence."," Ask your compliance lead to confirm the Cryptographic Module Validation Program status of any library you plan to use ",[21,470,291],{},[12,472,474],{"id":473},"questions-to-ask-your-team-this-week","Questions to ask your team this week",[264,476,477,480,483,486,492,500,503,506],{},[267,478,479],{},"Which of our systems establish keys today, and which of them could adopt ML-KEM first?",[267,481,482],{},"Where do we sign code, certificates and documents, and which signatures must stay trustworthy for many years?",[267,484,485],{},"Which of our suppliers have published support for FIPS 203, 204 and 205?",[267,487,488,489,491],{},"Do we plan to use a hybrid group such as X25519MLKEM768, or a standalone algorithm, and who decided ",[21,490,169],{},"?",[267,493,494,495,497,498,491],{},"Can our network gear and clients handle ML-DSA signatures of 2.4 to 4.6 KB ",[21,496,91],{},", and larger ones for SLH-DSA ",[21,499,157],{},[267,501,502],{},"Which libraries do we depend on, and does each hold the validation our regime requires?",[267,504,505],{},"Who tracks NIST's status on FN-DSA and HQC, and how often do they report?",[267,507,508],{},"Does anyone in our organization treat a draft as final? If so, where?",[12,510,512],{"id":511},"a-simple-owner-and-timeline-table","A simple owner and timeline table",[17,514,515],{},"ArcQubit guidance. Adjust the owners and dates to your organization.",[34,517,518,531],{},[37,519,520],{},[40,521,522,525,528],{},[43,523,524],{},"Action",[43,526,527],{},"Owner",[43,529,530],{},"Timing",[56,532,533,544,555,565,576],{},[40,534,535,538,541],{},[61,536,537],{},"Approve the target standards in policy",[61,539,540],{},"CISO with the architecture lead",[61,542,543],{},"Within 30 days",[40,545,546,549,552],{},[61,547,548],{},"Inventory key-establishment and signature use",[61,550,551],{},"Security engineering",[61,553,554],{},"Within 60 days",[40,556,557,560,563],{},[61,558,559],{},"Add standards and validation questions to supplier reviews",[61,561,562],{},"Procurement and compliance",[61,564,554],{},[40,566,567,570,573],{},[61,568,569],{},"Brief the board",[61,571,572],{},"CISO and CEO",[61,574,575],{},"Within 90 days",[40,577,578,581,584],{},[61,579,580],{},"Review NIST status on FN-DSA and HQC",[61,582,583],{},"Security architecture",[61,585,586],{},"Every quarter",[12,588,590],{"id":589},"what-it-costs-to-wait","What it costs to wait",[17,592,593],{},"We cannot put a dollar figure on delay, and we will not invent one. We can name where the cost shows up.",[264,595,596,602,608,614],{},[267,597,598,601],{},[229,599,600],{},"Data already collected."," An attacker who records encrypted traffic today can try to decrypt it once a capable quantum computer exists. Waiting does not undo the recording.",[267,603,604,607],{},[229,605,606],{},"Procurement lead time."," Products you buy now stay in service for years. If they lack the finished standards, you will replace or upgrade them under pressure.",[267,609,610,613],{},[229,611,612],{},"Supplier dependence."," Your vendors ship the algorithms you use. If they lag, you lag, and you have less leverage once your renewal date arrives.",[267,615,616,619,620,622],{},[229,617,618],{},"Audit exposure."," U.S. civilian agencies already work from a list that names FIPS 203, 204 and 205 ",[21,621,157],{},", and your supply chain may inherit those questions.",[12,624,626],{"id":625},"common-mistakes-and-how-to-avoid-them","Common mistakes and how to avoid them",[264,628,629,640,649,658,667,675],{},[267,630,631,634,635,24,637,639],{},[229,632,633],{},"Waiting for FN-DSA or HQC."," Neither is final ",[21,636,23],{},[21,638,27],{},". The three finished standards already cover your first steps. Start there.",[267,641,642,645,646,648],{},[229,643,644],{},"Treating a draft as a standard."," NSA says that versions of Kyber or Dilithium that do not adhere to FIPS 203 or 204 are not CNSA 2.0 compliant ",[21,647,225],{},". Confirm final status before you deploy.",[267,650,651,654,655,657],{},[229,652,653],{},"Confusing ML-DSA and SLH-DSA."," ML-DSA is the general default. SLH-DSA is a fallback with larger signatures and slower signing ",[21,656,157],{},". Do not use it everywhere because it sounds safer.",[267,659,660,663,664,666],{},[229,661,662],{},"Ignoring signature size."," Larger signatures can strain bandwidth in some uses ",[21,665,157],{},". Test your protocols before you commit.",[267,668,669,672,673,28],{},[229,670,671],{},"Skipping module validation."," A correct algorithm in an unvalidated module may still fail your compliance test ",[21,674,291],{},[267,676,677,680],{},[229,678,679],{},"Quoting a status you have not checked."," Status for FN-DSA and HQC changes. Check NIST's post-quantum project page before you tell your board.",[12,682,684],{"id":683},"a-worked-example","A worked example",[17,686,687],{},"A mid-sized services firm runs customer portals, an internal code-signing pipeline and a private certificate authority. Its CISO reads this guide and takes four steps.",[17,689,690,691,693],{},"First, she asks each team to list where the firm establishes keys and where it signs. Second, she picks the customer portals as the first ML-KEM target because they carry the data that an adversary would most want to store. Third, she sets ML-DSA as the default for code signing and holds the private certificate authority for review, since its roots of trust must last. That review asks whether an SLH-DSA fallback makes sense, at the cost of larger signatures ",[21,692,157],{},". Fourth, she tells procurement to ask suppliers about validation status, and she puts FN-DSA and HQC on a quarterly watch list.",[17,695,696],{},"She briefs the board with one page: the three standards, the two pending ones, the systems in scope, the owners, and the dates. The board approves the plan without needing to weigh any algorithm.",{"title":698,"searchDepth":699,"depth":699,"links":700},"",2,[701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716],{"id":14,"depth":699,"text":15},{"id":31,"depth":699,"text":32},{"id":147,"depth":699,"text":148},{"id":184,"depth":699,"text":185},{"id":200,"depth":699,"text":201},{"id":212,"depth":699,"text":213},{"id":237,"depth":699,"text":238},{"id":261,"depth":699,"text":262},{"id":295,"depth":699,"text":296},{"id":364,"depth":699,"text":365},{"id":422,"depth":699,"text":423},{"id":473,"depth":699,"text":474},{"id":511,"depth":699,"text":512},{"id":589,"depth":699,"text":590},{"id":625,"depth":699,"text":626},{"id":683,"depth":699,"text":684},"Compliance","2026-07-23","A guide to NIST's post-quantum standards: what FIPS 203, 204 and 205 do, where FN-DSA and HQC stand, and which standard fits which job.",false,"md",[723,726,729,732],{"q":724,"a":725},"Which NIST standard should I adopt first?","Start with ML-KEM for key establishment, because the harvest-now, decrypt-later risk targets confidentiality [1].",{"q":727,"a":728},"Are the finished standards ready for production?","NIST finalized them in August 2024 [1], [2], [3]. Confirm that your chosen library holds the module validation your compliance regime requires [10].",{"q":730,"a":731},"What is the difference between ML-DSA and SLH-DSA?","ML-DSA rests on lattices and gives smaller signatures. SLH-DSA rests on hash functions, which makes it a fallback independent of lattice assumptions, at the cost of larger signatures [6].",{"q":733,"a":734},"Do I need FN-DSA or HQC?","Not yet. Neither is final, and the three finished standards cover key establishment and signatures [1], [2], [3], [4].",[736],"gaithersburg",[738],"Cross-Sector",{},"2026-09-30",true,"\u002Fblog\u002Fnist-pqc-standards-guide",[744,747,750,753,756,759,762,765,768,771],{"label":745,"url":746},"National Institute of Standards and Technology, \"Module-Lattice-Based Key-Encapsulation Mechanism Standard,\" FIPS 203, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F203\u002Ffinal",{"label":748,"url":749},"National Institute of Standards and Technology, \"Module-Lattice-Based Digital Signature Standard,\" FIPS 204, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F204\u002Ffinal",{"label":751,"url":752},"National Institute of Standards and Technology, \"Stateless Hash-Based Digital Signature Standard,\" FIPS 205, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F205\u002Ffinal",{"label":754,"url":755},"National Institute of Standards and Technology, \"NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption,\" NIST News, Mar. 11, 2025","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2025\u002F03\u002Fnist-selects-hqc-fifth-algorithm-post-quantum-encryption",{"label":757,"url":758},"National Institute of Standards and Technology, \"PQC Standardization Process,\" NIST Computer Security Resource Center, updated Aug. 5, 2026","https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Fpost-quantum-cryptography\u002Fpost-quantum-cryptography-standardization",{"label":760,"url":761},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":763,"url":764},"K. Kwiatkowski, P. Kampanakis, B. E. Westerbaan, and D. Stebila, \"Post-Quantum Traditional (PQ\u002FT) Hybrid Key Agreement Mechanisms for TLS 1.3,\" RFC 10024, Aug. 2026","https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc10024",{"label":766,"url":767},"A. Robinson, \"FIPS 207: HQC-KEM,\" NIST Sixth PQC Standardization Conference, Sep. 25, 2025","https:\u002F\u002Fcsrc.nist.gov\u002Fpresentations\u002F2025\u002Ffips-207-hqc-kem",{"label":769,"url":770},"National Security Agency, \"The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ,\" Ver. 2.1, Dec. 2024","https:\u002F\u002Fmedia.defense.gov\u002F2022\u002FSep\u002F07\u002F2003071836\u002F-1\u002F-1\u002F0\u002FCSI_CNSA_2.0_FAQ_.PDF",{"label":772,"url":773},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",[775,778,779,782,785],{"label":776,"url":777},"Post-Quantum Cryptography Explained","\u002Fblog\u002Fpost-quantum-cryptography-explained",{"label":180,"url":179},{"label":780,"url":781},"Migration Roadmap","\u002Fblog\u002Fpqc-migration-roadmap",{"label":783,"url":784},"Global Mandates and Deadlines","\u002Fblog\u002Fpqc-mandates-deadlines",{"label":786,"url":787},"What NIST Post-Quantum Cryptography Standards Mean for Your Organization","\u002Fblog\u002Fwhat-nist-post-quantum-cryptography-standards-mean",{"title":5,"description":719},"NIST PQC Standards Guide: FIPS 203, 204, 205","nist-pqc-standards-guide",[792,793],"NIST finalized three post-quantum standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) (NIST, 2024).","FIPS 204 lists ML-DSA signature sizes of 2,420 bytes, 3,309 bytes and 4,627 bytes across its three parameter sets (NIST, 2024).","blog\u002Fnist-pqc-standards-guide",[796,63,80,96,66,797],"NIST PQC standards","compliance guide","NIST has finalized three post-quantum standards, FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for signatures and FIPS 205 (SLH-DSA) as a hash-based backup, with FN-DSA and HQC still in progress.","4ojTRGhcexO1QtFqc_bf_Njuz51bsV3w7FAf2nSBojM",1792182884194]