FIPS 203/204/205 Explained: The New Post-Quantum Cryptography Standards

Every organization running RSA or ECC-based encryption today is protecting data with cryptography that has a known, approaching expiration date. Not because RSA is broken right now — it isn’t — but because a sufficiently capable quantum computer will eventually be able to break it, and the standards designed to replace it are no longer theoretical. NIST finalized three post-quantum cryptography standards in 2024: FIPS 203, 204, and 205. Here’s what each one actually does.

Why Three Standards, Not One

Cryptography protecting a system generally needs to do two distinct jobs: establish a shared secret between two parties (key encapsulation), and prove that a message genuinely came from who it claims to (digital signatures). RSA and elliptic-curve cryptography currently handle both jobs, but neither is quantum-resistant on its own. NIST’s three finalized standards split the replacement across these functions, with an intentional redundancy built in for the signature side.

FIPS 203 — ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism)

ML-KEM is the post-quantum replacement for what RSA and Diffie-Hellman key exchange currently do: establishing a shared secret between two parties over an insecure channel, which becomes the foundation for encrypting everything that follows in a session. It’s built on lattice-based cryptography, a mathematical approach believed to resist attack by both classical and quantum computers. In practice, ML-KEM is the standard that shows up in TLS handshakes, VPN tunnels, and anywhere else a secure channel needs to be established — the most foundational and highest-volume of the three standards in terms of where it actually gets deployed.

FIPS 204 — ML-DSA (Module-Lattice-Based Digital Signature Algorithm)

ML-DSA is the primary post-quantum digital signature standard, replacing what RSA signatures and ECDSA currently do: proving a message, certificate, or piece of code genuinely originated from its claimed source and hasn’t been tampered with. Also lattice-based, it’s designed to be the default choice for most signature use cases — code signing, certificate authorities, document signing — going forward.

FIPS 205 — SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)

SLH-DSA is a second, independent digital signature standard, deliberately built on a different mathematical foundation — hash-based cryptography rather than lattice-based. This isn’t redundancy for its own sake: if a future cryptanalytic breakthrough weakens lattice-based schemes specifically, having a structurally independent backup already standardized and available means the response is “switch to the other standard,” not “start from scratch.” It’s typically positioned for higher-assurance use cases where that independence is worth its larger signature size and slower performance compared to ML-DSA.

The Timeline That Actually Matters

The genuinely urgent detail isn’t when quantum computers capable of breaking RSA-2048 will exist — current projections put that in the 2028–2030 window, which still sounds comfortably distant. It’s that a typical enterprise migration to post-quantum cryptography takes 12 to 15 years to complete once every dependency is accounted for: infrastructure, application code, certificates, and the full vendor and cloud provider supply chain. Measured against a 2028–2030 threat window, an organization starting migration today is already running behind the timeline, not ahead of it.

Compounding that gap: “harvest now, decrypt later” attacks are not a future risk — they’re understood to already be happening. Adversaries capturing RSA/ECC-encrypted traffic today don’t need a working quantum computer now; they need one to exist before the captured data stops being sensitive. For anything with a long confidentiality requirement — government records, health data, trade secrets, long-term financial data — that clock started when the data was first encrypted with classical cryptography, not when quantum capability actually arrives.

What This Means Practically

None of this requires an organization to have deep in-house cryptography expertise to start — which is fortunate, because that expertise is in genuinely short supply globally, with a well-documented shortage of practitioners trained specifically in ML-KEM, ML-DSA, and SLH-DSA. What it requires is starting the process: understanding where RSA and ECC dependencies actually exist across infrastructure, code, and vendor relationships, and building a prioritized, phased path to these three standards before the 12-to-15-year migration timeline runs out of room against the 2028–2030 threat window. That process — not just the standards themselves — is covered in the PQC migration roadmap.