Skip to content

Communication security

The quantum threat, key encapsulation and digital signatures, NIST's completed standards, and HQC's selection as a mathematically different backup for ML-KEM.

Post-Quantum Cryptography

Post-quantum cryptography addresses the mathematical protection of information against attacks from a sufficiently capable quantum computer. The principal set completed by the National Institute of Standards and Technology (NIST) includes a standard for general encryption and two standards for digital signatures. Its selection of HQC as a backup for ML-KEM adds a different mathematical approach to the key-encapsulation task: the opening handshake between parties that want to exchange confidential information over a public network.

The Quantum Threat

Encryption tools rely on mathematical problems that conventional computers find difficult or impossible to solve. NIST explains that a sufficiently capable quantum computer could work through a vast number of potential solutions very quickly and thereby defeat current encryption.

The design aim of the algorithms NIST finalized is to withstand cyberattacks from a quantum computer. In an encryption scheme, the obstacle faced by an attacker is the difficult mathematics; the quantum threat is that a different kind of computer could overcome that obstacle.

What Key Encapsulation Does

A key encapsulation mechanism, or KEM, is used over a public network as an opening handshake between two parties that want to exchange confidential information. ML-KEM and HQC are both KEMs.

ML-KEM occupies that role as NIST's main algorithm for general encryption; HQC was selected as its backup.

What Digital Signatures Do

Protecting digital signatures is the purpose NIST assigns to two other algorithms in its completed set. One is designated the primary standard for that purpose, and the other is also designed for digital signatures. Their names are ML-DSA and SLH-DSA, with DSA expanding to Digital Signature Algorithm.

The expanded names also identify different mathematical approaches within the signature pair: ML-DSA is module-lattice-based, while SLH-DSA is stateless and hash-based.

The Completed Standards

NIST announced its principal set of finalized standards on August 13, 2024. Its announcement of the three completed standards identifies both the standard numbers and the algorithm names. FIPS expands to Federal Information Processing Standard.

FIPS 203: General encryption

FIPS 203 is intended as the primary standard for general encryption. It is based on CRYSTALS-Kyber, which was renamed ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism.

FIPS 204: The primary signature standard

FIPS 204 is intended as the primary standard for protecting digital signatures. It uses CRYSTALS-Dilithium, renamed ML-DSA: Module-Lattice-Based Digital Signature Algorithm.

FIPS 205: Another signature standard

FIPS 205 is also designed for digital signatures. It employs Sphincs+, renamed SLH-DSA: Stateless Hash-Based Digital Signature Algorithm.

Why HQC Adds Mathematical Diversity

On March 11, 2025, NIST selected HQC as a backup for ML-KEM. NIST identifies a possible weakness in ML-KEM as the scenario in which HQC's different mathematics could become important.