NIST’s PQC Standards (ML-KEM, ML-DSA, SLH-DSA, Falcon, HQC) Explained
Let’s say you have one job. Pick the cryptographic algorithms that will protect everyone’s data after quantum computers exist. You don’t know exactly when those computers will arrive or which math will hold up against them. And you have to ship something soon enough that the world has time to migrate before they do.
That’s NIST’s job, and they’ve been on it since 2016. Welcome to the cryptographic hedge.
The cryptographic hedge is what NIST built when they realized the safe answer to “which post-quantum algorithm should we standardize” was “don’t pick just one.” The current count is five, picked across different math families on purpose. If any one family turns out to have a problem cryptographers haven’t spotted yet, the others survive.
That’s the whole article in three paragraphs. The rest is going through the lineup.
The lineup
NIST’s competition started in 2016 with 82 submissions. By 2022 the competition had narrowed to the algorithms that would become today’s standards. August 2024 brought the first batch of three FIPS standards. ML-KEM became FIPS 203 for key exchange. ML-DSA and SLH-DSA became FIPS 204 and 205 for signatures.
Falcon followed in 2025 as FIPS 206, still in draft, renamed FN-DSA along the way. HQC was added in March 2025 as a non-lattice backup KEM.
Five algorithms in three math families. Time to walk through them.
The lattice family has three kids
Three lattice-based algorithms made the final cut. ML-KEM does key exchange and serves as a Diffie-Hellman replacement. The other two, ML-DSA and FN-DSA, are signature schemes with different size and implementation trade-offs.
There’s a reason to be excited and a reason to worry. Lattice math has held up to decades of cryptanalysis. Hard lattice problems are the closest thing the post-quantum world has to “well-understood,” so if lattices are secure, the whole NIST portfolio is in good shape.
The worry is that cryptographers don’t have proofs that lattice problems are quantum-hard. They have very strong evidence, but the evidence isn’t a proof. If somebody finds a fast lattice algorithm in 2031, three of the five NIST standards become questionable on the same day.
ML-DSA is the workhorse of the lattice signature pair. Its signatures are around 3 KB at the standard security level. FN-DSA’s signatures are smaller (closer to 700 bytes), which makes it attractive for bandwidth-constrained applications. The catch with FN-DSA is implementation difficulty. It requires precise floating-point math, and getting it wrong opens side-channel attacks that lattice schemes are otherwise reasonably resistant to.
ML-KEM is the key exchange half. Public keys are around 1 KB. Performance is fast on commodity hardware. The algorithm gradually replacing Diffie-Hellman in TLS handshakes a few years from now is probably this.
The hash-pilled one (SLH-DSA)
If lattices break, the hedge kicks in. SLH-DSA is the part of the portfolio that doesn’t care about lattice math at all. It’s built on hash functions, full stop. The same hash functions that protect Bitcoin block headers and most of the rest of computer security.
SLH-DSA’s security rests on whether SHA-256 (and friends) have hidden weaknesses cryptographers haven’t found in fifty years of looking. They probably don’t. That assumption is among the most stress-tested in the field.
The price you pay for that conservatism is signature size. SLH-DSA signatures range from about 8 KB at the smallest parameters up to about 49 KB at the largest. For comparison, an ECDSA signature is 72 bytes. SLH-DSA signatures are 100 to 700 times bigger.
Low-bandwidth applications with high security stakes are SLH-DSA’s natural home. Real-time apps with tight bandwidth budgets need something smaller.
The insurance policy (HQC)
HQC is the youngest standard, and the only one in the portfolio that isn’t lattice-based or hash-based. It’s code-based, drawing from Hamming Quasi-Cyclic codes (yes, the name is the math). NIST selected HQC in March 2025 specifically as a backup KEM, in case ML-KEM’s lattice assumptions ever turn out to be weaker than expected.
This is because if lattices have a hidden weakness, the three lattice-based algorithms in the portfolio break together. That takes out most of the standard in a single hit. With HQC in the portfolio, the key exchange half of post-quantum cryptography (PQC) survives even if lattices break.
The trade-off, as you’d expect, is size. HQC public keys are several times larger than ML-KEM’s. Performance is also slower. ML-KEM wins for everyday use. HQC wins if the threat model includes “lattice math has a problem we haven’t found yet.”
Why five and not one
NIST learned from AES. They picked one algorithm (Rijndael) back then, and it’s been fine. They could have lost.
The post-quantum process itself taught the same lesson. Several candidates in the early rounds of the competition got broken during the competition. Math that looked safe in 2017 was broken in 2022. The cryptographers who design the algorithms are the same cryptographers who break them, and the gap between proposed and broken is sometimes years.
Five algorithms in three math families is a way to be reasonably confident that some of the portfolio survives even if one family doesn’t.
How this touches your coins (probably not yet)
If you’re a crypto holder, almost none of the NIST standards directly apply to what you do tomorrow. Bitcoin still uses ECDSA, the same scheme it’s had since 2009. Your wallet uses BIP-32 derivation. No PQC equivalent has been deployed yet. Migration to any of these standards happens at the protocol layer, well before it shows up in your day-to-day holdings.
What’s worth knowing is the structure of the migration that’s coming. When Bitcoin (or any chain you hold) eventually adopts PQC signatures, it’ll pick from this portfolio. ML-DSA is the most likely candidate because the size trade-offs are most reasonable for on-chain use. The dark horses are SLH-DSA (if the community decides to err toward conservative math) and FN-DSA (if signature size becomes the binding constraint).
ML-KEM and HQC are interesting if you care about secure communication. They’re less directly relevant to holding coins.
The honest “what should you do” answer is “watch the BIP discussions.” Most of the migration politics will play out in standards bodies and developer mailing lists. The algorithm names you’ll hear most often are the ones above.
Five algorithms, one field
The portfolio is built to fail safely. Eventually one of these standards probably gets broken. The other four keep working. That’s the whole hedge.