Standards Landscape

Post-quantum cryptography is being standardized in parallel by national standards bodies, international organizations, and protocol working groups. Understanding who publishes what — and how the pieces fit together — is the first step in any migration program.

Why standardization matters

Cryptographic algorithms only become deployable once they are precisely specified, validated, and blessed by a recognized authority. A standard fixes parameter sets, encodings, and test vectors so that independent implementations interoperate and so that procurement, compliance, and certification regimes have something concrete to point at. For PQC, the anchor is the U.S. National Institute of Standards and Technology (NIST), but it is far from the only player.

NIST: the primary anchor

NIST ran an open, multi-round competition from 2016 to 2024. On 13 August 2024 it published the first three finished standards as Federal Information Processing Standards (FIPS). NIST also publishes Special Publications (SP) for usage guidance and Internal Reports (IR) for strategy.

NIST IR 8547 (Initial Public Draft, Nov 2024) lays out a transition roadmap: it proposes that quantum-vulnerable public-key algorithms at 112-bit security strength be deprecated after 2030 and disallowed after 2035, while RSA/ECC/finite-field DH and other quantum-vulnerable public-key algorithms at 128-bit security strength and above are disallowed after 2035. It frames the migration timeline that organizations are now planning against. NIST IR 8545 (final, Mar 2025) documents the rationale for selecting HQC in the fourth round, and NIST IR 8528 (final, 2024) reports on the first round of the additional digital-signature on-ramp.

IETF: protocols and encodings

Algorithms are useless until protocols carry them. The Internet Engineering Task Force (IETF) is defining how PQC slots into the wire formats everyone already uses:

• TLS 1.3 — named groups for ML-KEM and hybrid key exchange (X25519+ML-KEM-768).
• SSH — post-quantum key exchange methods.
• X.509 / CMS — the IETF has published RFCs with some algorithm identifiers and encodings for ML-DSA, SLH-DSA, and ML-KEM in X.509/CMS; composite signatures, composite KEM, and some TLS bindings remain at the Internet-Draft stage.
• Hybrid combiners — guidance on safely concatenating classical and PQC shared secrets so security holds if either component survives.

International and national bodies

European agencies (BSI, ANSSI) have been notably cautious, emphasizing hybrid deployment — running a classical and a post-quantum algorithm together — until confidence in the new schemes matures. China pursues its own commercial cryptography track in parallel.

Standards & references

• FIPS 203 — ML-KEM (final, 13 Aug 2024)
• FIPS 204 — ML-DSA (final, 13 Aug 2024)
• FIPS 205 — SLH-DSA (final, 13 Aug 2024)
• SP 800-208 — Stateful Hash-Based Signatures (final, Oct 2020)
• SP 800-227 — Recommendations for KEMs (final, Sept 2025)
• NIST IR 8547 — Transition to PQC Standards (Initial Public Draft, Nov 2024)
• NIST IR 8545 — Fourth Round Status Report (final, Mar 2025)
• NIST IR 8528 — Additional Signatures Round 1 Status Report (final, 2024)
• NIST Post-Quantum Cryptography project
• NCCoE SP 1800-38 — Migration to Post-Quantum Cryptography (preliminary drafts)