The NIST Post-Quantum Standards Explained: ML-KEM, ML-DSA, SLH-DSA And What Comes Next

When people talk about “the NIST post-quantum standards”, they usually mean three documents published in August 2024. Two more are on the way, a guidance document on key encapsulation was finalised in 2025, and a separate competition for extra signature schemes is still running. Keeping track of which is final and which is still a plan matters, because procurement teams and auditors will ask.

This article explains what each standard does, where it came from, and its status as of 7 October 2026.

The Three Final Standards

NIST published three Federal Information Processing Standards on 13 August 2024.¹

FIPS 203, ML-KEM. The Module-Lattice-Based Key-Encapsulation Mechanism, derived from CRYSTALS-Kyber. A key encapsulation mechanism (KEM) lets two parties establish a shared secret over a public network, which then keys a symmetric cipher such as AES. NIST calls ML-KEM its primary standard for general encryption.¹ It comes in three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, and NIST recommends ML-KEM-768 as the default.²

FIPS 204, ML-DSA. The Module-Lattice-Based Digital Signature Algorithm, derived from CRYSTALS-Dilithium. It is NIST’s primary standard for digital signatures, with parameter sets ML-DSA-44, ML-DSA-65 and ML-DSA-87.¹

FIPS 205, SLH-DSA. The Stateless Hash-Based Digital Signature Algorithm, derived from SPHINCS+. Its security rests only on hash functions, a different foundation from the lattice problems behind ML-KEM and ML-DSA. NIST positions it as a backup in case ML-DSA turns out to be weaker than expected.¹ Its signatures are many times larger than ML-DSA’s, which is the price of that conservative design.

Standards Still In Preparation

FIPS 206, FN-DSA. This will standardise Falcon, the compact lattice signature scheme NIST selected in 2022. NIST has described FN-DSA as producing much smaller signatures than ML-DSA but being harder to implement, because Falcon as submitted uses floating-point arithmetic in key generation and signing.³ In a public mailing list post on 28 August 2025, NIST’s Dustin Moody said the draft was essentially complete and had been sent up the chain for approval.⁴ The plan then changed. On 28 September 2026 NIST’s FIPS 206 team proposed that the draft should instead specify fixed-point arithmetic for both key generation and signing, with a single signing procedure that implementations must match exactly in testing, and asked the community for feedback.⁵ As of 7 October 2026, no public draft of FIPS 206 appears on NIST’s publications site.⁶

FIPS 207, HQC. NIST selected HQC in March 2025 as a second KEM, based on error-correcting codes rather than lattices, so that a weakness in ML-KEM would not leave organisations without an option. At the time NIST said it planned a draft in about a year and a final standard in 2027.⁷ NIST presented the planned contents of FIPS 207 at its September 2025 standardisation conference.⁸ In August 2026 it told its public mailing list that it was preparing to release the initial public draft soon.⁹ As of 7 October 2026, that draft has not appeared.⁶

Guidance Around The Standards

SP 800-227. Published in final form in September 2025, this NIST Special Publication explains how key encapsulation mechanisms work, the security properties they offer, and how to implement and use them safely.¹⁰ It is the practical companion to FIPS 203 and to the coming HQC standard.

SP 800-208. Published in October 2020, before the main competition ended, it approves two stateful hash-based signature schemes, LMS and XMSS, for specialised uses such as firmware signing.¹¹ A later article in this section explains why they are treated differently.

NIST IR 8547. An initial public draft from November 2024 that proposes timelines for retiring quantum-vulnerable algorithms. As of October 2026 it remains a draft.¹²

More Signatures On The Way

Both ML-DSA and FN-DSA rest on lattice problems. To avoid depending on one family for most signatures, NIST issued a separate call for additional signature schemes in September 2022.¹³ Fourteen candidates reached the second round in October 2024.¹⁴ On 14 May 2026 NIST advanced nine to a third round: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign and UOV.¹⁵

NIST’s round three page, updated on 28 September 2026, reports that the HAWK team has withdrawn its submission, leaving eight active candidates and no lattice schemes among them.¹⁶ The page gives no date or reason for the withdrawal. Any standard from this process is still several years away.

What This Means For Buyers

For procurement and architecture decisions in 2026, the three final standards are the ones to ask for by name. A supplier claiming post-quantum support should be able to say which of ML-KEM, ML-DSA and SLH-DSA it implements, which parameter sets it uses, and whether the implementation follows the final FIPS text rather than an earlier competition version such as Kyber or Dilithium. The NSA, for example, states that implementations which do not follow FIPS 203 or 204 do not count as compliant with its CNSA 2.0 suite, even if they carry the older names.¹⁷

For FN-DSA and HQC, the sensible position is to design for them without depending on them. Leave room in protocols and key stores for another algorithm, and revisit once NIST publishes drafts.