NIST finalizes the first post-quantum cryptographic standards
On August 13, 2024, NIST published the first three finalized cryptographic standards designed to resist attacks from quantum computers: ML-KEM, ML-DSA, and SLH-DSA. The release concludes an eight-year standardization effort that began with 82 algorithm submissions from the global cryptographic community in 2017 and ended with a painstaking selection process involving multiple rounds of evaluation and cryptanalysis.
Why the quantum threat matters now
Most encryption in use today relies on mathematical problems—like factoring very large numbers—that are intractable for classical computers. Quantum computers change that calculus. While no machine exists yet that is large or stable enough to break current cryptography, a 2023 survey found that more than a quarter of interviewed experts consider it more likely than not that a cryptographically-relevant quantum computer (CRQC) will arrive within the next decade.
The threat is not purely hypothetical for future communications. Under the "harvest now, decrypt later" model, an adversary can record encrypted traffic today and decrypt it once a sufficiently powerful quantum computer exists. That makes upgrading key agreement protocols urgent, not optional.
Splitting the problem: key agreement vs. signatures
The migration effort breaks into two distinct categories with very different timelines and challenges.
Key agreement lets two parties establish a shared secret over an insecure channel, which they then use to encrypt their traffic. Since only the client and server need to coordinate on a new protocol, upgrading is relatively straightforward. The industry has already moved in this direction. Cloudflare has been running a hybrid variant, X25519Kyber, a preliminary version of ML-KEM, since 2022. As of mid-August 2024, over 16% of human-generated requests to Cloudflare's servers are already protected with this pre-standard version.
Other major players—Google, Apple, Meta, and Signal—have deployed post-quantum key agreement as well. Cloudflare plans to upgrade its systems to support the final ML-KEM standard (again in a hybrid configuration with X25519), coordinating with partners at NIST's NCCoE and the IETF. The pre-standard X25519Kyber768 will be phased out gradually as clients move to the ML-KEM-768 hybrid; X25519Kyber512, which never saw real-world use, will be dropped quickly.
Digital signatures face a different, harder path. Signatures underpin the WebPKI, where certificates prove that a website operator legitimately owns a domain. The threat model is different—an adversary who can forge signatures could execute an active impersonation attack, but today's traffic is not yet at risk since no CRQC exists. The migration is nevertheless far more complex because of the number of parties involved: library developers, browsers, server operators, certificate authorities, and hardware manufacturers all must coordinate. Post-quantum signatures are also much larger than traditional ones, complicating deployment.
Progress is underway, with large-scale feasibility experiments on post-quantum signatures in the WebPKI already performed and more studies planned. But the first post-quantum certificates are not expected until 2026, and they will not be enabled by default when they arrive. Organizations should prepare for a future flip-the-switch migration but should not rush to flip it now.
What the new standards cover
The three finalized standards address the two core cryptographic functions:
ML-KEM— for post-quantum key agreement.ML-DSAandSLH-DSA— for post-quantum digital signatures.
A fourth standard, based on the FALCON signature scheme, is slated for release in late 2024 under the name FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm).
Preparing for a hybrid future
Widespread adoption of ML-KEM is expected now that the final standard exists, as support rolls out in both software and hardware. The hybrid approach—combining post-quantum with classical cryptography—remains a hedge against future advances in cryptanalysis or implementation vulnerabilities, and it is the model Cloudflare intends to follow when upgrading to the standardized ML-KEM.
Organizations should audit their systems and prioritize upgrading key agreement to protect data from future quantum-capable adversaries. Users can check whether their browser already supports post-quantum key agreement at pq.cloudflareresearch.com. The signature migration, meanwhile, will take longer, requiring sustained coordination across the WebPKI ecosystem before it becomes the default.
