FIPS 203, 204 and 205 in Plain Words, ML-KEM, ML-DSA and SLH-DSA

On 13 August 2024, NIST published its first three post-quantum standards. Three numbers, three acronyms, and the question every team asks next. Which one do we use?

They do different jobs. One protects confidentiality, two protect authenticity, and the choice between those two depends on how long a signature must hold.

FIPS 203, ML-KEM, to agree on a key

ML-KEM, the Module-Lattice-Based Key-Encapsulation Mechanism, takes the place of RSA encryption and Diffie-Hellman exchanges. It does not encrypt the data itself. It lets two parties share a 32-byte secret, and a symmetric algorithm such as AES encrypts the data with it. Its security rests on a lattice problem, Module Learning with Errors.

• ML-KEM-512. NIST security category 1. Public key of 800 bytes, ciphertext of 768 bytes.
• ML-KEM-768. Category 3. 1,184 and 1,088 bytes.
• ML-KEM-1024. Category 5. 1,568 and 1,568 bytes.

For comparison, an X25519 public key takes 32 bytes. The post-quantum exchange costs bandwidth, which matters for a network protocol far more than for a file.

FIPS 204, ML-DSA, the everyday signature

ML-DSA, the Module-Lattice-Based Digital Signature Algorithm, takes the place of RSA and ECDSA signatures. It rests on the same family of lattice problems as ML-KEM, signs and verifies fast, and produces signatures of a few kilobytes.

• ML-DSA-44. Category 2. Public key of 1,312 bytes, signature of 2,420 bytes.
• ML-DSA-65. Category 3. 1,952 and 3,309 bytes.
• ML-DSA-87. Category 5. 2,592 and 4,627 bytes.

FIPS 205, SLH-DSA, the conservative signature

SLH-DSA, the Stateless Hash-Based Digital Signature Algorithm, derives from SPHINCS+. Its security rests on hash functions alone, the best understood assumption in cryptography. The price is size and signing time. Its public key is tiny, 32 to 64 bytes, and its signatures range from 7,856 bytes to almost 50 kilobytes.

Its 12 parameter sets combine SHA-2 or SHAKE, three security levels (128, 192 and 256), and a choice between small signatures, marked s, and fast signing, marked f.

Which one for what

• Encrypting data, stored or sent. ML-KEM, combined with a classical ECDH exchange.
• Signing in volume. ML-DSA with a classical co-signature, when signatures must stay small and fast to produce.
• Signing what must stay provable for decades. SLH-DSA, for contracts, archives and evidence. Hash functions are the safest bet over a long horizon.
• The level. Category 3 or 5 for data that must hold beyond 2030. ANSSI's mechanisms guide prefers ML-KEM-768 or above.

What ANSSI adds

ANSSI insists strongly on hybridization of post-quantum algorithms wherever they are deployed. In its guide on cryptographic mechanisms, version 3.00 of March 2026, ML-KEM and ML-DSA used alone do not meet its rules, whatever the parameter set. SLH-DSA does, and can be used as it is after 2030. In the regulated scope, hybridization is mandatory.

What comes next

• FN-DSA. A lattice signature derived from Falcon, with smaller signatures, expected as FIPS 206. NIST has not published its draft yet.
• HQC. A second key-encapsulation mechanism, built on error-correcting codes instead of lattices, selected in March 2025 as a backup to ML-KEM. NIST plans to finalize its standard in 2027.
• The end of RSA and elliptic curves. In a draft of November 2024, NIST IR 8547, NIST proposes to deprecate them at 112-bit security after 2030 and to disallow them after 2035.

One standard to agree on a key, two to sign. The choice between the two depends on how long the signature must hold.

In Feranor PQC Suite

Feranor PQC Suite uses the three standards under its ANSSI profile. ML-KEM-768 or 1024 combined with ECDH for encryption, ML-KEM-1024 with ECDH P-384 by default. SLH-DSA at 192 or 256 bits, co-signed with ECDSA P-384, for signatures. ML-DSA is available in the standard profile, and will join the ANSSI profile as a composite signature once the platform supports it in CMS. The primitives come from OpenSSL 3.5, checked against NIST's official vectors.