PQC Ready · practical transition guidance

NIST post-quantum standards: FIPS 203, 204 and 205

Understand ML-KEM, ML-DSA and SLH-DSA, their different roles and what adopting NIST post-quantum standards requires.

Published and reviewed 15 September 2026 · PQC Ready, a brand of SDTC Solutions Ltd

Three standards, different jobs

NIST published FIPS 203, 204 and 205 in August 2024. FIPS 203 specifies ML-KEM for key encapsulation: establishing a shared secret for use with symmetric protection. It is not a bulk-data encryption algorithm.

FIPS 204 specifies ML-DSA, a lattice-based digital-signature algorithm. FIPS 205 specifies SLH-DSA, a stateless hash-based digital-signature algorithm. Signatures support authenticity and integrity; they do not encrypt the signed content.

An algorithm is only part of deployment

Adoption depends on protocol support, implementation quality, key management and operational compatibility. Selecting a standardised algorithm does not establish that an entire product or deployment is validated or secure.

Prepare an implementation decision

Identify whether a dependency needs key establishment, signatures or both. Ask the supplier which protocol and product versions support the required mechanism, what interoperability has been tested and how keys and certificates are managed.

In a pilot, examine message sizes, latency, storage, resource limits and failure behaviour. Embedded and long-lived systems may have constraints that a desktop test does not reveal.

Maintain the baseline

Record the standard, implementation version and configuration used. Monitor official notices and supplier updates rather than treating the first successful installation as a permanent end state.

Continue exploring

PQC glossary: terminology and standards explained