ML-KEM, ML-DSA & SLH-DSA Explained
In August 2024, NIST finalized three post-quantum standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). Together they cover the two cryptographic primitives that public-key infrastructure depends on — key establishment and digital signatures — with diversified mathematical foundations.
ML-KEM (FIPS 203) — key establishment
Module-Lattice Key Encapsulation Mechanism, derived from CRYSTALS-Kyber. Replaces RSA-KEM and ECDH for establishing shared symmetric keys. Already shipping in production TLS 1.3 hybrid deployments at Google, Cloudflare, and AWS. Performance is competitive with ECDH; bandwidth overhead is modest.
ML-DSA (FIPS 204) — primary signatures
Module-Lattice Digital Signature Algorithm, derived from CRYSTALS-Dilithium. Lattice-based. The default PQ signature for most use cases: code signing, document signing, certificate issuance. Signature sizes are larger than ECDSA but acceptable.
SLH-DSA (FIPS 205) — diversified backup
Stateless Hash-Based Digital Signature Algorithm, derived from SPHINCS+. Security rests only on hash-function assumptions — no lattice math. Signatures are large and slow, but the design is the most conservative bet against future cryptanalysis. The standard choice when you need diversification from lattice schemes.
What's still coming
NIST is finalizing FN-DSA (Falcon, FIPS 206) for smaller signatures and running a fourth round for KEM diversification (HQC selected in 2025 as a non-lattice backup to ML-KEM). Plan for hybrid deployments — classical plus PQ — until at least 2030.
Key takeaways
- Three finalized standards: ML-KEM, ML-DSA, SLH-DSA.
- ML-KEM replaces ECDH for key exchange; ML-DSA is the default signature.
- SLH-DSA is the diversified hash-based backup against lattice risk.
- Hybrid (classical + PQ) deployments are the safe path until ~2030.