Post-quantum cryptography: FIPS 203, 204, 205 and the migration ahead

What the standards are

Most public-key cryptography in use today, such as RSA and elliptic-curve Diffie-Hellman, relies on maths problems that a large, fault-tolerant quantum computer could solve efficiently using Shor’s algorithm. No such machine exists yet, but data captured today could be decrypted later. This "harvest now, decrypt later" risk is why standards bodies started early.

After a public competition that began in 2016, NIST published three Federal Information Processing Standards on 13 August 2024:

A fourth signature standard, FN-DSA (based on Falcon, to be FIPS 206), offers smaller signatures and is still being finalised. In March 2025 NIST also selected HQC, a code-based key encapsulation scheme, as a backup to ML-KEM in case lattice assumptions are ever weakened; a draft standard was expected about a year later, with the final version planned for 2027.

Why it matters

Key exchange protects confidentiality, so it is the urgent part: anything recorded now could be exposed in future. Signatures protect authenticity at the moment of verification, so they are less urgent for short-lived data but critical for long-lived roots of trust such as firmware signing keys, certificate authorities and hardware that stays in the field for 15 years or more.

Key ideas

• KEMs replace Diffie-Hellman style exchange. A key encapsulation mechanism lets one side encapsulate a random secret to the other side’s public key. Protocols such as TLS need small changes to use it.
• Bigger keys and signatures. ML-KEM-768 public keys are about 1.2 KB and ML-DSA signatures are a few kilobytes, far larger than elliptic-curve equivalents. This affects handshake size, certificate chains and constrained devices.
• Hybrid deployment. Combining a classical algorithm with a post-quantum one means an attacker must break both. The X25519MLKEM768 group for TLS 1.3 is the leading example, and major browsers have used it by default since late 2024.
• Crypto-agility. Systems should be able to swap algorithms through configuration rather than code rewrites. This is the single most useful engineering property for the coming decade.

What changed recently

Timelines have become concrete. NIST’s draft report IR 8547 (November 2024) proposed deprecating quantum-vulnerable algorithms at the 112-bit security level after 2030 and disallowing them after 2035. The UK NCSC published migration milestones in 2025: complete discovery and planning by 2028, finish the highest-priority migrations by 2031, and complete migration by 2035. On the deployment side, hybrid post-quantum key exchange is now negotiated for a large share of web traffic through major browsers and content delivery networks, so many users are already protected for confidentiality without noticing.

How practitioners apply it

1. Build a cryptographic inventory. List protocols, libraries, certificates, hardware security modules, VPNs (see IPsec), code-signing and any embedded devices. Include suppliers.
2. Rank by data lifetime and exposure. Data that must stay secret for ten years or more, and devices that cannot be updated, go first.
3. Ask suppliers for roadmaps. Most organisations will receive PQC through vendor updates to operating systems, browsers, VPN gateways and cloud services.
4. Enable hybrid key exchange where your platforms support it and test for middleboxes that break on larger handshakes.
5. Plan the PKI change. Post-quantum certificates and signatures need new hierarchies, so test chain sizes and validation performance early.

For background on symmetric versus asymmetric cryptography, see the cryptography note. Symmetric algorithms such as AES-256 and hash functions such as SHA-256 are not seriously threatened and remain in use.

A practical lab exercise is to capture a TLS handshake from a current browser with a packet analyser and look at the key share. You will see the hybrid group identifier and a key share of over a kilobyte, compared with 32 bytes for plain X25519. That single observation explains why some older firewalls and load balancers that assume a small ClientHello have caused connection failures during rollout.

Limitations and open questions

• Timing is uncertain. Nobody can say when a cryptographically relevant quantum computer will exist. The timelines are risk management, not predictions.
• Implementation risk. New algorithms bring new side-channel and implementation bugs. Use validated libraries rather than writing your own.
• Constrained devices. Smart cards, IoT sensors and industrial controllers may lack memory or bandwidth for large keys.
• Some standards are still moving. FN-DSA and HQC are not yet final, and protocol specifications for certificates and hybrid signatures are still settling.