Post-Quantum Cryptography Goes Official

For years, post-quantum cryptography has lived in a strange middle ground. Everyone in security took it seriously as a coming problem, but almost nobody had to actually do anything about it yet. That changed on August 13, 2024, when the US National Institute of Standards and Technology finalized its first three post-quantum cryptography standards. The conversation just moved from theoretical to mandatory.

What NIST actually published

After an eight-year public evaluation process that started in 2016, NIST released three finished Federal Information Processing Standards: FIPS 203, FIPS 204, and FIPS 205. Each addresses a different piece of the cryptographic puzzle that quantum computers threaten to break.

• FIPS 203, ML-KEM: a module lattice based key encapsulation mechanism, derived from the CRYSTALS-Kyber algorithm, designed as the primary quantum-resistant replacement for key exchange methods like RSA and ECDH.
• FIPS 204, ML-DSA: a lattice based digital signature algorithm, derived from CRYSTALS-Dilithium, intended to replace signature schemes such as ECDSA and RSA signatures for authentication and integrity.
• FIPS 205, SLH-DSA: a stateless hash based signature scheme, derived from SPHINCS+, offering a more conservative fallback whose security doesn't depend on lattice hardness assumptions at all.

Together, these standards cover the two fundamental operations that quantum computers threaten: securely exchanging keys, and proving a message or signature is authentic. NIST wasn't shy about the urgency either, the agency's own release explicitly encouraged system administrators to begin transitioning as soon as possible, rather than treating this as a future planning exercise.

Why "eventually" quietly became "now"

The threat model behind post-quantum cryptography has always had an odd shape. A sufficiently powerful quantum computer capable of breaking current encryption doesn't exist yet, and estimates on when one might vary widely. But that's not really the point. Adversaries with the resources to do so can harvest encrypted communications today and simply wait, storing intercepted data until the decryption capability catches up. For anything that needs to stay confidential for years or decades, government communications, defence planning, long-term diplomatic and legal records, that harvest-now-decrypt-later risk is already live, regardless of when a quantum computer actually arrives.

Finalized standards change the calculus in a very practical way. Before August 2024, organizations planning a transition were building against draft specifications that could still shift. Now there's a fixed target, and one that the US government has already signaled it expects agencies and vendors serving them to move toward.

What this means for anyone handling sensitive communications

For governments, defence organizations, and any business handling information that needs to stay confidential well into the future, this is the moment the migration conversation stops being optional.

• Standards are no longer a moving target: organizations that were waiting for the dust to settle before committing engineering time to post-quantum migration now have a stable, finalized specification to build against.
• Harvest-now-decrypt-later risk applies immediately: anything encrypted today with classical algorithms alone is potentially exposed the moment a capable quantum computer exists, which means the transition window is really measured from now, not from whenever that computer arrives.
• Procurement and vendor evaluation criteria will shift: expect government and defence buyers to start asking directly whether the systems they're evaluating already support ML-KEM, ML-DSA, or SLH-DSA, rather than treating quantum resistance as a roadmap item.

We've already made this shift ourselves. Silentel runs FIPS 203, 204, and 205 in production, layered on top of our existing ECC-521 implementation, rather than treating post-quantum cryptography as something to plan for later. Given how long some communications need to stay confidential, that's not a feature to defer. NIST just made it the baseline everyone else will be measured against.