ML-KEM, ML-DSA and SLH-DSA: the NIST standards explained

ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism, is the standard for setting up a shared secret at the start of a connection. It grew out of the algorithm known during the competition as CRYSTALS-Kyber, and its security rests on the hardness of structured lattice problems.

This is the one that matters most for harvest now, decrypt later, because key establishment is the part of a session an attacker can break retroactively. It is almost always deployed in hybrid form, paired with a classical exchange such as X25519, so that a weakness in either component alone still leaves the connection protected. The hybrid group you will see negotiated on modern servers is written X25519MLKEM768.

ML-DSA, Module-Lattice-Based Digital Signature Algorithm, is the general-purpose signature standard, derived from CRYSTALS-Dilithium. Signatures prove who you are and that data was not altered. ML-DSA is the one to use for most new signing needs because it is efficient and lattice-based, matching ML-KEM.

SLH-DSA, Stateless Hash-Based Digital Signature Algorithm, comes from SPHINCS+. Instead of lattices it relies only on the security of hash functions, which are very well understood. Its signatures are larger and slower, so it is not the everyday choice, but it is the conservative backup: if a weakness were ever found in lattice math, SLH-DSA would still stand.

NIST is deliberately keeping more than one option in each category, so a single mathematical surprise cannot undo the whole transition.

• HQC was selected in March 2025 as a second key-establishment mechanism. It is code-based rather than lattice-based, a different foundation from ML-KEM, and a draft standard is expected around 2027.
• FN-DSA (from Falcon) is a further lattice-based signature standard in progress, useful where small signatures matter.

• Setting up an encrypted connection: ML-KEM, in hybrid.
• Signing, as a default: ML-DSA.
• Signing, where you want the most conservative assurance: SLH-DSA.

A readiness assessment tests for the first of these, ML-KEM key exchange, because it is both the most urgent and the part that is visible from outside a system.