NIST Security Strength Categories
NIST defines five security strength categories (Levels 1 through 5) for post-quantum algorithms. Each level is anchored to the cost of breaking a well-understood symmetric primitive, accounting for both classical and quantum attackers. Picking the right level is the first design decision in any PQC migration.
What the levels mean
Rather than quote a single bit-strength number, NIST anchors each category to the difficulty of attacking AES or SHA-2/SHA-3 with the best known classical and quantum algorithms. An algorithm claims a given level if breaking it is at least as hard as the anchor problem.
| Level | Anchor | Interpretation |
|---|---|---|
| 1 | AES-128 key search | At least as hard as a brute-force key recovery on AES-128 |
| 2 | SHA-256 / SHA3-256 collision | At least as hard as finding a collision in a 256-bit hash |
| 3 | AES-192 key search | At least as hard as a brute-force key recovery on AES-192 |
| 4 | SHA-384 / SHA3-384 collision | At least as hard as finding a collision in a 384-bit hash |
| 5 | AES-256 key search | At least as hard as a brute-force key recovery on AES-256 |
Why AES and hashes? They are the most studied primitives we have, and the quantum speedups against them are well understood. Level 1 is anchored to the resource cost of attacking AES-128 key search. While Grover's algorithm can offer a quadratic speedup against an idealized exhaustive search, NIST's security categories compare the total computational resources required to carry out the relevant reference attack rather than reducing it to a simple "64-bit security" figure. Hash collisions sit between the key-search levels because collision-finding has its own classical and quantum cost profile.
How algorithms map to levels
Most NIST PQC schemes ship in several parameter sets, each targeting a specific category. Larger parameters mean a higher level — and bigger keys, ciphertexts, and signatures.
| Algorithm / parameter set | Type | Level |
|---|---|---|
| ML-KEM-512 | KEM | 1 |
| ML-KEM-768 | KEM | 3 |
| ML-KEM-1024 | KEM | 5 |
| ML-DSA-44 | Signature | 2 |
| ML-DSA-65 | Signature | 3 |
| ML-DSA-87 | Signature | 5 |
| Falcon-512 | Signature | 1 |
| Falcon-1024 | Signature | 5 |
| SLH-DSA-128s / 128f | Signature | 1 |
| SLH-DSA-192s / 192f | Signature | 3 |
| SLH-DSA-256s / 256f | Signature | 5 |
Note the spans: lattice KEMs and the SLH-DSA / Falcon signature families each cover the 1/3/5 range, while ML-DSA starts at Level 2. There is no single algorithm that occupies every level, so a migration that mandates "Level 3 everywhere" still requires per-primitive parameter choices.
Choosing a level
The level you target balances long-term confidentiality requirements against size and performance cost.
- Level 1 — adequate for ephemeral, short-lived secrets where any captured data is worthless within months. Smallest and fastest.
- Level 3 — the pragmatic default for most deployments.
ML-KEM-768andML-DSA-65are the common interoperability choices, balancing margin against size. - Level 5 — for data with a multi-decade confidentiality horizon, root CAs, firmware signing keys, and anything covered by Harvest Now, Decrypt Later (HNDL) concerns.
Two further rules of thumb:
- Match the level to the longest-lived asset the key protects, not the session. A TLS session key may live seconds, but the data it protects may need 30 years of secrecy.
- It is fine to mix levels: a Level 5 root CA can sign Level 3 intermediate certificates. The chain is only as strong as the weakest link on the path you care about, so anchor trust high and operate at Level 3.
parameters.html before committing.Related
Standards & references
- FIPS 203 (ML-KEM) — defines the security strength categories its parameter sets target.
- FIPS 204 (ML-DSA) — maps its parameter sets to the same NIST categories.
- FIPS 205 (SLH-DSA) — defines its category claims for each parameter set.
- NIST Post-Quantum Cryptography project — origin of the five-category security strength framework.
- Resources — full standards register
NIST 安全强度等级
NIST 为后量子算法定义了五个安全强度等级（Level 1 至 Level 5）。每个等级都以一种公认的对称原语的破解成本为锚点，并同时考虑经典攻击者和量子攻击者。选定合适的等级，是任何 PQC 迁移工作的第一项设计决策。
各等级的含义
NIST 并不直接给出某个比特强度数值，而是把每个等级锚定到用当前最优经典和量子算法攻击 AES 或 SHA-2/SHA-3 的难度上。只要破解某算法的难度不低于对应锚点问题，它就可以声称达到该等级。
| 等级 | 锚点 | 含义 |
|---|---|---|
| 1 | AES-128 密钥穷举 | 破解难度不低于对 AES-128 做暴力密钥恢复 |
| 2 | SHA-256 / SHA3-256 碰撞 | 破解难度不低于在 256 位哈希中寻找碰撞 |
| 3 | AES-192 密钥穷举 | 破解难度不低于对 AES-192 做暴力密钥恢复 |
| 4 | SHA-384 / SHA3-384 碰撞 | 破解难度不低于在 384 位哈希中寻找碰撞 |
| 5 | AES-256 密钥穷举 | 破解难度不低于对 AES-256 做暴力密钥恢复 |
为什么选 AES 和哈希作锚点？因为它们是研究最透彻的原语，针对它们的量子加速也最为清楚。Level 1 以攻击 AES-128 密钥搜索的资源成本为锚点。虽然 Grover 算法可为理想穷举搜索带来平方级加速，但 NIST 的安全等级定义比较的是完成相应参考攻击所需的综合计算资源，而不是简单换算成“64 位安全”。哈希碰撞之所以落在两个密钥穷举等级之间，是因为碰撞查找有其各自的经典与量子成本特征。
算法到等级的映射
大多数 NIST PQC 方案都提供多组参数，分别对应不同等级。参数越大等级越高，相应的密钥、密文和签名也越大。
| 算法 / 参数组 | 类型 | 等级 |
|---|---|---|
| ML-KEM-512 | KEM | 1 |
| ML-KEM-768 | KEM | 3 |
| ML-KEM-1024 | KEM | 5 |
| ML-DSA-44 | 签名 | 2 |
| ML-DSA-65 | 签名 | 3 |
| ML-DSA-87 | 签名 | 5 |
| Falcon-512 | 签名 | 1 |
| Falcon-1024 | 签名 | 5 |
| SLH-DSA-128s / 128f | 签名 | 1 |
| SLH-DSA-192s / 192f | 签名 | 3 |
| SLH-DSA-256s / 256f | 签名 | 5 |
注意各方案覆盖的跨度：格 KEM 以及 SLH-DSA、Falcon 签名族都横跨 1/3/5，而 ML-DSA 从 Level 2 起步。没有任何单一算法占满全部等级，因此即便迁移规范要求“全面达到 Level 3”，仍需为每种原语单独选定参数。
如何选择等级
选定等级，本质上是在长期机密性需求与体积、性能成本之间权衡。
- Level 1 — 适用于短寿命的临时密钥，被截获的数据在数月内即失去价值。体积最小、速度最快。
- Level 3 — 多数部署的务实默认值。
ML-KEM-768与ML-DSA-65是常见的互操作选择，在安全裕度与体积之间取得平衡。 - Level 5 — 用于机密期长达数十年的数据、根 CA、固件签名密钥，以及一切受“先收集、后解密（Harvest Now, Decrypt Later, HNDL）”威胁影响的场景。
另有两条经验法则：
- 等级应匹配密钥所保护资产中寿命最长者，而非会话本身。TLS 会话密钥可能只存活数秒，但它保护的数据或许需要保密 30 年。
- 混用等级是可行的：Level 5 的根 CA 可以签发 Level 3 的中间证书。在你关心的那条路径上，链条强度取决于最薄弱环节，因此可将信任锚点设得很高，而在 Level 3 上运行。
parameters.html。相关链接
标准与参考
- FIPS 203 ML-KEM — 定义其参数组所对标的安全强度等级。
- FIPS 204 ML-DSA — 将其参数组映射到同一套 NIST 等级。
- FIPS 205 SLH-DSA — 为各参数组界定其等级声明。
- NIST 后量子密码项目 — 五级安全强度框架的出处。
- 资源链接 — 完整标准登记册