From 2016 to FIPS 203: How NIST Picked Post-Quantum Cryptography

The National Institute of Standards and Technology has run its post-quantum cryptography selection process since 2017. Estimates suggest a quantum computer could break the widely deployed RSA algorithm as early as 2030. The NIST process is the main joint effort to develop and evaluate algorithms resistant to quantum attacks. It proceeds in several rounds, each accompanied by a conference. Every round eliminates some algorithms and subjects others to closer scrutiny.

Most symmetric cryptographic primitives adapt to quantum security relatively easily. Doubling key lengths, for example, neutralizes the speed-up provided by Grover's algorithm. Efforts therefore focus on asymmetric cryptography, particularly digital signatures and key encapsulation mechanisms. Future standards are published as Federal Information Processing Standards, including FIPS 203, FIPS 204, and FIPS 205.

A template taken from AES

The process format is proven, open, and transparent, modeled on the AES standardization process of 1997-2000. Academic research into the potential impact of quantum computing dates back at least to 2001. In 2015, US federal authorities announced plans to migrate all government information processing systems subject to confidentiality requirements to quantum-resistant cryptography. At the PQCrypto conference in 2016, NIST announced the standardization of quantum-safe cryptographic primitives. In December 2016, the process launched with a call for proposals.

By the end of 2017, when submissions closed, 23 digital signature systems and 59 encryption and key encapsulation methods had been submitted. Of these, 69 were deemed complete and eligible for the first round, with 23 candidates advancing to further work. Seven algorithms and eight alternative candidates passed the second round. On 22 July 2020, NIST announced seven finalists, including three signature systems, plus eight alternative solutions.

Who won, who fell

The third round saw CRYSTALS-Kyber win as a key encapsulation mechanism, and CRYSTALS-Dilithium, FALCON, and SPHINCS+ as digital signature systems. These are currently being standardized by NIST. The fourth round, announced in July 2022 to examine four additional algorithms, was still ongoing in March 2024. In 2024, NIST published the final versions of its first three post-quantum cryptography standards. Two lattice-based algorithms made the first cut: ML-KEM, widely known as Kyber, and ML-DSA, known as Dilithium. Not every construction survived. The widely discussed SIDH/SIKE construction was spectacularly broken in 2022, although the attack targeted only that family of schemes and does not generalize to other isogeny-based constructions.