Post-Quantum Cryptography Standards Tracker
The production-ready NIST post-quantum standards are FIPS 203 for ML-KEM, FIPS 204 for ML-DSA, and FIPS 205 for SLH-DSA. FN-DSA and HQC remain under standardization, while IETF, NSA, ETSI, and BSI guidance defines how these primitives should move into protocols and enterprise migration programs.
NIST algorithm and transition status
“Final” means an approved NIST publication available for implementation. “In development” means selection or drafting is underway and the result must not be represented as a finalized standard.
| Publication | Primitive | Status | Enterprise interpretation | Primary source |
|---|---|---|---|---|
| FIPS 203 | ML-KEM key encapsulation | Final · Aug 2024 | Primary NIST-standardized mechanism for post-quantum key establishment. | NIST FIPS 203 |
| FIPS 204 | ML-DSA digital signatures | Final · Aug 2024 | General-purpose lattice-based signature standard for authentication and integrity. | NIST FIPS 204 |
| FIPS 205 | SLH-DSA digital signatures | Final · Aug 2024 | Stateless hash-based signature alternative with different security assumptions. | NIST FIPS 205 |
| FIPS 206 | FN-DSA, derived from FALCON | In development | Do not treat FN-DSA as a finalized FIPS until NIST publishes the final standard. | NIST selected algorithms |
| HQC | Code-based backup KEM | Selected · Mar 2025 | NIST selected HQC to diversify the KEM portfolio; ML-KEM remains the recommended general-encryption choice. | NIST HQC announcement |
| NIST IR 8547 | Transition planning | Initial public draft | Useful for planning, but identify it as draft guidance when setting policy or deadlines. | NIST IR 8547 IPD |
Protocol and migration ecosystem
Algorithm publication is only the first layer. Secure adoption also depends on protocol specifications, validated implementations, procurement requirements, inventory, interoperability, and controlled migration.
| Body | Tracked work | Current status | What teams should do | Primary source |
|---|---|---|---|---|
| IETF | ML-KEM key agreement for TLS 1.3 | Internet-Draft -09 IESG Last Call ending August 13, 2026 | Track the Datatracker rather than freezing an implementation to an obsolete draft revision. | IETF Datatracker |
| NSA | CNSA 2.0 and NSS transition resources | Policy guidance | Use CNSA requirements for applicable National Security Systems; do not generalize them into universal commercial mandates. | NSA PQC resources |
| ETSI | Repeatable framework for quantum-safe migrations | Published · Oct 2024 | Use the framework to organize discovery, risk assessment, planning, execution, and validation. | ETSI TR 104 016 |
| BSI | Migration to post-quantum cryptography | Published guidance | Evaluate BSI’s hybrid-migration recommendations in the context of system assurance and applicable jurisdiction. | BSI migration guidance |
What security teams should do now
Inventory cryptographic dependencies
Map algorithms, libraries, protocols, certificates, keys, owners, data lifetimes, and external dependencies before selecting replacements.
Separate standards status from migration risk
Prioritize long-lived sensitive data and exposed key-establishment paths while tracking whether each target primitive and protocol is final or still changing.
Test implementations and interoperability
Measure performance, side-channel resistance, certificate and message-size effects, rollback behavior, observability, and operational recovery before broad rollout.