ISO/IEC & ITU-T

The international standards system gives PQC global reach. ISO/IEC JTC 1/SC 27 is the international home for cryptographic standards and typically adopts and aligns with NIST output, while ITU-T SG17 carries quantum-safe security into the telecom world. For many buyers, an ISO/IEC reference is what makes an algorithm procurable.

Why the international layer matters

A FIPS is a US federal standard. Many governments and enterprises outside the US prefer — or are required — to cite an international standard. ISO/IEC and ITU-T provide that layer: they take cryptography that has been analyzed and selected elsewhere and place it inside globally recognized standards families, smoothing cross-border procurement, certification, and compliance.

ISO/IEC JTC 1/SC 27

SC 27 (with cryptographic work centered in WG 2) is the international home for cryptographic mechanisms. Its established families are now incorporating PQC:

• ISO/IEC 18033-2 is the standards family for asymmetric encryption mechanisms; international adoption of PQC KEMs will typically proceed within this series or related revisions, and the specific project stage should be confirmed against the current ISO/IEC JTC 1/SC 27 work items.
• ISO/IEC 14888-3:2018 — discrete-logarithm-based signatures with appendix, which already includes SM2 and SM9.
• ISO/IEC 14888-4:2024 — stateful hash-based signatures (XMSS/LMS family), published in 2024.
• ISO/IEC AWI 14888-5 — lattice-based signatures (ML-DSA/FN-DSA family), in development.
• ISO/IEC WD 14888-6 — stateless hash-based signatures (SLH-DSA family), in development.
• ISO/IEC 11770-3:2021 — key management using asymmetric techniques, key establishment.

SC 27 is also working to standardize the NIST lattice schemes internationally (see 14888-5 above). In practice, ISO often adopts or aligns with NIST output rather than designing competing algorithms, which keeps the global ecosystem coherent. For the stateful hash-based context, compare with SP 800-208.

ITU-T SG17 — telecom security

ITU-T Study Group 17 is the telecommunication standardization sector's security group. Its quantum-related work spans two strands:

• Quantum-safe guidance for telecom security mechanisms — X.1811 (Apr 2021), "Security guidelines for applying quantum-safe algorithms in IMT-2020 systems", carries algorithmic PQC into 5G.
• QKD networking — the X.1710-series addresses the architecture and security of quantum key distribution networks: X.1710 (2020) security framework for QKD networks, X.1713 (2024) protection of QKD nodes, and X.1714 (2020) key combination for QKDN. Note this is a different technology track from the algorithmic PQC that NIST standardizes. Do not treat QKD networking standards as PQC algorithm standards.

Relationship to NIST

What this means for planning

If your obligations are framed in ISO/IEC terms, watch SC 27 for the international adoption of ML-KEM and ML-DSA and for the 14888-4 stateful hash-based work. Because ISO aligns with NIST, the underlying algorithms and parameters will match — the difference is the citation and certification path, not the cryptography. See the broader picture in Standards Overview.

Standards & references

• ISO/IEC 18033-2:2006 — Encryption algorithms, Part 2: Asymmetric ciphers (FDAmd 2 in progress)
• ISO/IEC 14888-3:2018 — Digital signatures with appendix, Part 3: Discrete logarithm based mechanisms
• ISO/IEC 14888-4:2024 — Digital signatures with appendix, Part 4: Stateful hash-based mechanisms
• ISO/IEC AWI 14888-5 — Part 5: Lattice-based mechanisms (in development)
• ISO/IEC WD 14888-6 — Part 6: Stateless hash-based mechanisms (in development)
• ISO/IEC 11770-3:2021 — Key management, Part 3: Mechanisms using asymmetric techniques
• ITU-T X.1710 (2020) — Security framework for QKD networks
• ITU-T X.1811 (2021) — Security guidelines for quantum-safe algorithms in IMT-2020 systems