In August 2024, NIST finalized the three cryptographic standards that will replace RSA and ECC across the world's digital infrastructure. This lesson covers all three in plain language, what they are, what problem each one solves, and what they replace. These are the most important terms in the entire course. Everything else builds on them.
Unit 1 progress
0.5 done1.11.7
By the end of this lesson you will be able to
Name all three NIST post-quantum standards and state what each one does
Explain what RSA and ECC are currently used for and which standard replaces each function
Distinguish between key encapsulation and digital signatures in plain language
Define post-quantum cryptography and explain why these three standards matter
Use all six glossary terms introduced in this lesson accurately in context
Part 1 — Why August 2024 mattered
For nearly three years, the cryptographic community waited for NIST to finalize its post-quantum standards. The process began in 2016, drew 82 initial submissions from researchers worldwide, and went through four rounds of evaluation. On August 13, 2024, NIST published three final standards simultaneously. This was not a soft launch or a draft, these were finalized, production-ready specifications that every technology vendor, government agency, and standards body in the world had been waiting for.
The three standards solve two different problems. One standard handles key exchange, the process of two parties agreeing on a shared secret over an insecure channel. Two standards handle digital signatures, the process of proving that a message or document came from a specific party and has not been altered. Together, they replace the cryptographic foundations of TLS, PKI, code signing, VPNs, and most other security infrastructure in use today.
Glossary term #1
Post-Quantum Cryptography (PQC)
Cryptographic algorithms designed to be secure against both classical and quantum computers. The replacement for RSA and ECC. PQC algorithms run on classical hardware, they do not require a quantum computer to operate, only to resist.
An important clarification before going further: post-quantum cryptography does not mean cryptography that runs on quantum computers. It means cryptography that runs on ordinary classical computers but is designed to resist attacks from quantum computers. The algorithms in FIPS 203, 204, and 205 will run on the same servers, laptops, and phones you use today. What changes is the mathematical problem underneath, replacing factoring and discrete logarithms with problems that quantum computers cannot solve efficiently.
Part 2 — The three standards
Select each standard to explore it in depth.
Part 3 — Why three standards, not one
A reasonable question at this point is: why three standards? RSA did two jobs, key exchange and signatures. Why not one post-quantum algorithm to replace everything? The answer comes down to three separate design requirements that no single algorithm optimally satisfies.
🔒
Different cryptographic operations
Key exchange and digital signatures are mathematically distinct operations. An algorithm optimized for one is not necessarily optimal for the other. Separating them produces better performance in both.
🛡️
Diversity of security assumptions
ML-KEM and ML-DSA both rely on lattice problems. SLH-DSA relies on hash functions, a completely different mathematical foundation. If a breakthrough attack ever weakened lattice-based algorithms, SLH-DSA would remain secure. Redundancy is a feature, not a flaw.
⚡
Performance trade-offs
SLH-DSA produces larger signatures and is slower to sign, but its security rests on the most conservative, well-understood mathematical foundation available. For high-assurance or long-lived signatures, that trade-off is acceptable.
Part 4 — What replaces what
The table below maps current algorithms to their post-quantum replacements. This is the migration map at its highest level. Units 2 through 4 work through each row in depth.
Current algorithm
Used for
Broken by
Replaced by
RSA (key exchange)
Establishing shared session keys in TLS, VPN, email
Shor's algorithm
ML-KEM / FIPS 203
ECDH / DH
Diffie-Hellman key agreement in TLS 1.3, Signal, SSH
Notice that AES and SHA are not replaced, they are upgraded. Only algorithms based on factoring (RSA) or discrete logarithms (ECC) are broken entirely by Shor's algorithm. Symmetric encryption and hashing are only weakened by Grover's algorithm, and doubling key size restores security. This distinction is important for migration prioritization: RSA and ECC are urgent; AES and SHA upgrades are important but less critical.
Lattice-based: Algorithms whose security rests on the mathematical hardness of problems involving high-dimensional geometric lattices. The basis of ML-KEM and ML-DSA. Believed to resist both classical and quantum attacks.
Hash-based: Algorithms whose security rests entirely on the properties of cryptographic hash functions, the most well-understood and conservatively proven foundation in modern cryptography. The basis of SLH-DSA.
Part 5 — The finalization date and what it means in practice
August 2024 matters not just as a milestone but as a starting gun. Before finalization, deploying these algorithms in production carried meaningful risk: NIST could still modify them, and early implementations might need to be replaced. After finalization, that risk disappears. Vendors can ship FIPS 203/204/205 implementations without fear that the standard will change under them. Government agencies can mandate them. Compliance frameworks can require them.
The practical consequence: every major TLS library, operating system, cloud provider, HSM vendor, and certificate authority is now on a clock to implement these standards. Some already have. Many are in progress. A small number are waiting. By the time you reach Unit 4, you will have the tools to assess where any given vendor sits on that spectrum.
Comprehension check
Question 1 of 3
Which NIST standard is the post-quantum replacement for RSA and ECDH when used for key exchange?
Question 2 of 3
SLH-DSA (FIPS 205) is described as a "conservative backup." What makes it conservative compared to ML-DSA?
Question 3 of 3
An organization's security team says: "We don't need to worry about PQC yet because we use AES-256 for everything." What is the most accurate response?