STANDARDS REFERENCE — NIST PQC STANDARDS
FIPS 203, 204, and 205 — The Finalized Post-Quantum Standards. Not Draft. Final.
On 13 August 2024, NIST published three Federal Information Processing Standards for post-quantum cryptography. These are not guidance or recommendations — they are finished standards. Migration planning against them can begin immediately.
- FIPS 203, 204 & 205 Finalized Specifications
- Key Encapsulation & Digital Signature Trade-offs
- India Deployment Guidance (Commercial & CII)
Standards Breakdown
What This Document Covers
NIST's post-quantum cryptography standards replace vulnerable public-key mechanisms across transport layers, identity, and authorization. Here is the operational analysis of each finalized standard.
FIPS 203 — ML-KEM (Key Encapsulation Mechanism)
Formerly CRYSTALS-Kyber. The primary standard for key encapsulation — replacing RSA key transport and Elliptic-Curve Diffie-Hellman (ECDH) for establishing shared secrets across TLS, SSH, and VPN connections.
- Parameter Sets: ML-KEM-512 (NIST Level 1), ML-KEM-768 (Level 3 — recommended for most enterprise use), and ML-KEM-1024 (Level 5 — required for CNSA 2.0 / NSA-classified environments).
- Public Key Size: ~1,184 bytes (ML-KEM-768).
- Ciphertext Size: ~1,088 bytes.
- Mathematical Basis: Module Learning with Errors (M-LWE).
FIPS 204 — ML-DSA (Digital Signature Algorithm)
Formerly CRYSTALS-Dilithium. The primary standard for digital signatures — replacing RSA-PKCS#1 and ECDSA for code signing, certificate signing, and protocol authentication.
- Parameter Sets: ML-DSA-44 (Level 2), ML-DSA-65 (Level 3 — recommended), ML-DSA-87 (Level 5 — CNSA 2.0).
- Signature Size: ~2,420 bytes (ML-DSA-65).
- Architectural Note: Substantially larger signature size vs. classical ECDSA (64–72 bytes) — directly impacts MTU limits and HTTP header constraints.
- Mathematical Basis: Fiat-Shamir with Aborts over module lattices.
FIPS 205 — SLH-DSA (Stateless Hash-Based Signatures)
Formerly SPHINCS+. A conservative fallback digital signature standard using a fundamentally different mathematical basis (hash-based, not lattice-based) from ML-DSA. Held in reserve against future cryptanalytic advances on lattice assumptions.
- Signature Size: Larger signatures (~7–50KB depending on parameter set).
- Latency Profile: Impractical for high-throughput, latency-sensitive transport authentication.
- Primary Use Cases: Long-lived, low-frequency signing — firmware verification, root certificate signing, and regulatory document preservation.
- Assurance: Immune to lattice-reduction mathematical breakthroughs.
FIPS 206 — FN-DSA / FALCON (Pending)
A compact lattice-based signature scheme (formerly FALCON) with significantly smaller signature sizes than ML-DSA (~666 bytes for FALCON-512), useful for embedded and bandwidth-constrained environments.
- Status: Pending finalization (expected publication 2026/2027).
- Signature Overhead: ~666 bytes (FALCON-512) vs ~2,420 bytes for ML-DSA-65.
- Roadmap Integration: AQRA's automated migration roadmaps will incorporate FN-DSA immediately once the official FIPS standard is finalized.
India Deployment Guidance
For enterprise, commercial, and critical infrastructure deployments across India, NIST and regulatory frameworks offer distinct target profiles:
- Commercial & Enterprise: Target ML-KEM-768 for key encapsulation and ML-DSA-65 for signatures.
- Defense & CII (Critical Information Infrastructure): Organizations aligned with NSA CNSA 2.0 or NCIIPC guidelines should target ML-KEM-1024 and ML-DSA-87.
- Symmetric Cryptography: AES-256 and SHA-3 are already quantum-resistant and require no algorithm replacement. Confirm your existing deployments enforce AES-256 rather than AES-128 (which offers only 64 bits of post-quantum security under Grover's algorithm).
KEY SIZE & PERFORMANCE COMPARISON
Classical vs Post-Quantum Overhead Matrix
Post-quantum cryptography trades larger public key and ciphertext/signature sizes for verifiable quantum resistance.
| Algorithm | Type | Security Level | Public Key | Ciphertext / Sig | Quantum Safe? |
|---|---|---|---|---|---|
| RSA-2048 | KEM / Sig | 112 bits | 256 B | 256 B | No (Shor's) |
| ECDH P-256 | Key Exchange | 128 bits | 64 B | 64 B | No (Shor's) |
| ML-KEM-768 | KEM | Cat 3 (AES-192) | 1,184 B | 1,088 B | YES (FIPS 203) |
| ML-DSA-65 | Signature | Cat 3 (AES-192) | 1,952 B | 2,420 B | YES (FIPS 204) |
| SLH-DSA-128f | Signature | Cat 1 (AES-128) | 32 B | 17,088 B | YES (FIPS 205) |
Related Technical Intelligence
Explore Related Research & Specifications
PQC Migration Blueprint
Engineering roadmap for discovering and migrating legacy algorithms to NIST standards.
Read Blueprint →CBOM Guide & Specification
Complete schema guide and taxonomy for CycloneDX 1.6 Cryptographic Bills of Materials.
Explore CBOM Guide →Air-Gap Architecture Spec
Zero-egress containerized deployment architecture for air-gapped financial and defense environments.
View Architecture →NEXT STEP
Ready to Apply This to Your Environment?
A scoping call maps the relevant standards and specifications to your specific infrastructure and regulatory obligations.