Algorithm Coverage
Coverage of NIST post-quantum algorithms across all tracked mandates.Required — explicitly mandated, non-compliance is a violation. Recommended — officially encouraged but not compelled. Noted — referenced for awareness only, no obligation attached. Prohibited — use is explicitly disallowed.
Coverage matrix
| Algorithm | NSA US CNSA-2 | NIST US IR-8547 | OMB US M-23-02 | CISA US PQC-INITIATIVE | NCSC UK UK-PQC | BSI Germany PQC-MIGRATION | ANSSI France PQC-POSITION | CSA Singapore SG-PQC | ASD Australia PQC | ENISA EU EU-NIS2 | CRYPTREC Japan PQC | NIST US SP-800-208 | ETSI Global ISG-QSC | IETF Global PQC-PROTOCOLS |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| FALCON (FN-DSA)FIPS 206 | — | REQ | — | — | — | — | — | — | — | — | — | — | — | — |
| HQC | — | — | — | — | — | — | — | — | — | — | — | — | NOTE | — |
| LMS / HSSSP 800-208 | REC | — | — | — | — | — | — | — | — | — | — | REC | — | REC |
| ML-DSAFIPS 204 | REQ | REQ | REQ | REC | REC | REC | REC | REC | REC | REC | REC | — | REC | REC |
| ML-KEMFIPS 203 | REQ | REQ | REQ | REC | REC | REC | REC | REC | REC | REC | REC | — | REC | REC |
| SLH-DSAFIPS 205 | REC | REQ | — | REC | NOTE | REC | — | — | NOTE | — | NOTE | — | — | REC |
| XMSSSP 800-208 | REC | — | — | — | — | — | — | — | — | — | — | REC | — | REC |
Algorithm reference
FALCON (FN-DSA)— FIPS 206
Replaces: ECDSA
Fast-Fourier Lattice-based Compact Signatures over NTRU, standardized as FN-DSA in FIPS 206 (October 2024). Produces significantly smaller signatures and public keys than ML-DSA, making it attractive for bandwidth-constrained environments such as TLS handshakes and embedded systems. Based on NTRU lattices with a discrete Gaussian sampler. Requires careful, constant-time implementation to avoid side-channel vulnerabilities.
Referenced in
- RequiredNISTNIST IR 8547: Transition to Post-Quantum Cryptography Standards
FN-DSA standardized in FIPS 206 (October 2024) and added to the approved algorithm set for federal use.
HQC
Replaces: RSA, ECDH
Hamming Quasi-Cyclic (HQC) is a code-based key encapsulation mechanism selected by NIST in March 2024 for standardization as a backup to ML-KEM. Based on the hardness of decoding random quasi-cyclic codes, it provides a mathematically distinct foundation from lattice-based ML-KEM, offering algorithmic diversity in case lattice assumptions are weakened. Draft NIST standard pending.
Referenced in
- NotedETSIETSI ISG QSC: Quantum Safe Cryptography Specifications
HQC noted by ETSI as a code-based alternative KEM offering algorithmic diversity alongside lattice-based schemes.
LMS / HSS— SP 800-208
Replaces: RSA, ECDSA
Leighton-Micali Hash-Based Signatures (LMS) with Hierarchical Signature Scheme (HSS) is a stateful hash-based signature scheme standardized in IETF RFC 8554 (2019) and approved for US federal use in NIST SP 800-208 (2020). Like XMSS, security relies only on hash function properties. Recommended by NSA CNSA 2.0 and NIST for firmware and software signing in National Security Systems. Stateful — requires strict state management to prevent catastrophic key reuse.
Referenced in
- RecommendedNSANSA Commercial National Security Algorithm Suite 2.0
Approved for firmware and software signing in NSS. Preferred stateful hash-based option for code signing use cases.
- RecommendedNISTNIST SP 800-208: Stateful Hash-Based Signature Schemes
LMS/HSS approved for federal use per SP 800-208. Recommended for firmware and software signing applications in federal systems.
- RecommendedIETFIETF Post-Quantum Cryptography Protocol Standards
Standardized in RFC 8554 (2019). Recommended for stateful hash-based signatures, particularly firmware and software signing.
ML-DSA— FIPS 204
Replaces: RSA, ECDSA
Module-Lattice-Based Digital Signature Algorithm standardized in FIPS 204 (August 2024). Based on the CRYSTALS-Dilithium submission. Provides quantum-resistant digital signatures as a replacement for RSA and ECDSA. Offers parameter sets at security levels 2, 3, and 5 corresponding to AES-128, AES-192, and AES-256 equivalent strength.
Referenced in
- RequiredNSANSA Commercial National Security Algorithm Suite 2.0
Required for digital signatures in NSS. ML-DSA-87 (level 5) mandated for most applications.
- RequiredNISTNIST IR 8547: Transition to Post-Quantum Cryptography Standards
Designated primary PQC signature algorithm for federal use per FIPS 204.
- RequiredOMBOMB Memorandum M-23-02: Migrating to Post-Quantum Cryptography
Agencies must plan migration to NIST-approved PQC signature schemes for authentication in federal systems.
- RecommendedCISACISA Post-Quantum Cryptography Initiative
CISA recommends adoption of FIPS 204 (ML-DSA) for digital signatures in critical infrastructure systems.
- RecommendedNCSCNCSC Guidance: Post-Quantum Cryptography Migration
NCSC recommends ML-DSA (FIPS 204) for post-quantum digital signatures in UK systems.
- RecommendedBSIBSI Migration Guide: Post-Quantum Cryptography
BSI recommends ML-DSA for post-quantum digital signatures in German government and critical infrastructure systems.
- RecommendedANSSIANSSI Position Paper on Post-Quantum Cryptography
ANSSI supports ML-DSA for post-quantum signatures, recommending hybrid schemes where possible during the transition period.
- RecommendedCSACSA Singapore Post-Quantum Cryptography Advisory
CSA recommends ML-DSA (FIPS 204) for digital signatures in post-quantum migration planning.
- RecommendedASDASD Post-Quantum Cryptography Guidance
ASD recommends ML-DSA (FIPS 204) for post-quantum authentication, aligned with NSA CNSA 2.0 and NIST guidance.
- RecommendedENISAEU NIS2 Directive — Cryptography & PQC Provisions
ENISA recommends entities evaluate ML-DSA (FIPS 204) for post-quantum authentication under NIS2 cybersecurity risk management obligations.
- RecommendedCRYPTRECCRYPTREC Post-Quantum Cryptography Guidelines
ML-DSA (FIPS 204) added to the CRYPTREC e-Government Recommended Ciphers List in 2025.
- RecommendedETSIETSI ISG QSC: Quantum Safe Cryptography Specifications
ETSI recommends ML-DSA for post-quantum digital signatures in hybrid schemes during the transition period.
- RecommendedIETFIETF Post-Quantum Cryptography Protocol Standards
X.509 certificate profiles for ML-DSA standardized by IETF LAMPS WG in 2025.
ML-KEM— FIPS 203
Replaces: RSA, ECDH
Module-Lattice-Based Key-Encapsulation Mechanism standardized in FIPS 203 (August 2024). Based on the CRYSTALS-Kyber submission. Provides quantum-resistant key exchange as a drop-in replacement for RSA and ECDH key encapsulation. Available in security levels 512, 768, and 1024 (roughly equivalent to AES-128, AES-192, and AES-256).
Referenced in
- RequiredNSANSA Commercial National Security Algorithm Suite 2.0
Required for key establishment in NSS. ML-KEM-1024 mandated for TOP SECRET systems.
- RequiredNISTNIST IR 8547: Transition to Post-Quantum Cryptography Standards
Designated primary PQC KEM for federal use per FIPS 203.
- RequiredOMBOMB Memorandum M-23-02: Migrating to Post-Quantum Cryptography
Agencies must plan migration to NIST-approved PQC KEMs for key exchange in federal systems.
- RecommendedCISACISA Post-Quantum Cryptography Initiative
CISA recommends adoption of FIPS 203 (ML-KEM) for key encapsulation in critical infrastructure systems.
- RecommendedNCSCNCSC Guidance: Post-Quantum Cryptography Migration
NCSC recommends ML-KEM (FIPS 203) as the primary post-quantum key encapsulation mechanism for UK organisations.
- RecommendedBSIBSI Migration Guide: Post-Quantum Cryptography
BSI TR-02102 recommends ML-KEM for post-quantum key encapsulation, preferably in hybrid mode with a classical KEM during transition.
- RecommendedANSSIANSSI Position Paper on Post-Quantum Cryptography
ANSSI recommends ML-KEM in hybrid mode with a classical KEM (e.g., ECDH) until PQC algorithms have established sufficient operational track record.
- RecommendedCSACSA Singapore Post-Quantum Cryptography Advisory
CSA recommends ML-KEM (FIPS 203) for post-quantum key encapsulation, aligned with NIST standardisation.
- RecommendedASDASD Post-Quantum Cryptography Guidance
ASD recommends ML-KEM (FIPS 203) for post-quantum key encapsulation in Australian government and defence systems, aligned with NSA CNSA 2.0.
- RecommendedENISAEU NIS2 Directive — Cryptography & PQC Provisions
ENISA recommends entities evaluate ML-KEM (FIPS 203) for post-quantum key exchange as part of cryptographic agility planning under NIS2.
- RecommendedCRYPTRECCRYPTREC Post-Quantum Cryptography Guidelines
ML-KEM (FIPS 203) added to the CRYPTREC e-Government Recommended Ciphers List in 2025.
- RecommendedETSIETSI ISG QSC: Quantum Safe Cryptography Specifications
ETSI TS 103 744 defines hybrid key exchange schemes incorporating ML-KEM combined with classical KEMs for TLS and other protocol contexts.
- RecommendedIETFIETF Post-Quantum Cryptography Protocol Standards
Standardized for use in TLS 1.3 via RFC 9370 (2025). Defines ML-KEM key exchange for TLS connections.
SLH-DSA— FIPS 205
Replaces: RSA, ECDSA
Stateless Hash-Based Digital Signature Algorithm standardized in FIPS 205 (August 2024). Based on the SPHINCS+ submission. Security relies solely on hash function properties, providing a conservative alternative to lattice-based schemes. Produces larger signatures but offers a security proof independent of structured mathematical hardness assumptions.
Referenced in
- RecommendedNSANSA Commercial National Security Algorithm Suite 2.0
Acceptable stateless alternative for firmware signing where the hash-based security proof is preferred.
- RequiredNISTNIST IR 8547: Transition to Post-Quantum Cryptography Standards
Alternative PQC signature algorithm for federal use per FIPS 205, preferred where hash-based security properties are desired.
- RecommendedCISACISA Post-Quantum Cryptography Initiative
CISA recommends FIPS 205 (SLH-DSA) as an alternative signature scheme, especially for code signing and firmware.
- NotedNCSCNCSC Guidance: Post-Quantum Cryptography Migration
SLH-DSA (FIPS 205) noted as an alternative signature scheme with conservative security assumptions.
- RecommendedBSIBSI Migration Guide: Post-Quantum Cryptography
BSI recommends SLH-DSA as a conservative alternative signature algorithm with well-understood security properties.
- NotedASDASD Post-Quantum Cryptography Guidance
SLH-DSA noted as an alternative signature scheme suitable for specific use cases such as firmware signing.
- NotedCRYPTRECCRYPTREC Post-Quantum Cryptography Guidelines
SLH-DSA under ongoing CRYPTREC evaluation; listed as a candidate for future cipher list inclusion.
- RecommendedIETFIETF Post-Quantum Cryptography Protocol Standards
X.509 certificate profiles for SLH-DSA standardized by IETF LAMPS WG in 2025.
XMSS— SP 800-208
Replaces: RSA, ECDSA
Extended Merkle Signature Scheme (XMSS) is a stateful hash-based signature scheme standardized in IETF RFC 8391 (2018) and approved for US federal use in NIST SP 800-208 (2020). Security depends solely on the security of the underlying hash function — no algebraic hardness assumptions. Stateful: signers must track signature count and never reuse one-time keys. Recommended for firmware signing and environments with low signing volume and careful state management.
Referenced in
- RecommendedNSANSA Commercial National Security Algorithm Suite 2.0
Approved for firmware and software signing in NSS where stateful operation is carefully managed.
- RecommendedNISTNIST SP 800-208: Stateful Hash-Based Signature Schemes
XMSS approved for federal use per SP 800-208. Recommended for firmware and software signing in federal systems.
- RecommendedIETFIETF Post-Quantum Cryptography Protocol Standards
Standardized in RFC 8391 (2018). Recommended for stateful hash-based signature use cases requiring long-term security guarantees.
Algorithm standards quick reference
| FIPS | Algorithm | Type | Status | Year |
|---|---|---|---|---|
| FIPS 203 | ML-KEM | KEM | Final | 2024 |
| FIPS 204 | ML-DSA | Signature | Final | 2024 |
| FIPS 205 | SLH-DSA | Signature | Final | 2024 |
| FIPS 206 | FALCON (FN-DSA) | Signature | Final | 2024 |
| SP 800-208 | XMSS / LMS | Signature | Final | 2020 |
| TBD | HQC | KEM | Candidate | — |
| RFC 8391 | XMSS | Signature | Final | 2018 |
| RFC 8554 | LMS / HSS | Signature | Final | 2019 |
Sources: NIST PQC project, IETF LAMPS WG, ETSI ISG QSC. FIPS 206 (FN-DSA) finalized October 2024. HQC standardization pending. SP 800-208 / RFC 8391 / RFC 8554 cover stateful hash-based schemes.