NIST standardization (Kyber, Dilithium)

Faced with the quantum threat, tested and public global standards had to be chosen. That is the role of NIST (the U.S. standardization institute), which ran an open competition from 2016 to 2024.

An open competition

NIST proceeded as it did for AES: a public call, dozens of candidates from around the world, years of cryptanalysis carried out by the community. Fragile schemes were eliminated in the open. Some favorites even collapsed along the way, which validates the approach: it is better for a system to fall during the competition than after its deployment.

In 2024, NIST published the first official post-quantum standards.

The two flagship standards

The two winners both rest on the lattices seen in the previous lesson.

NIST standard	Based on	Type	Use
ML-KEM	CRYSTALS-Kyber	lattices (KEM)	key exchange
ML-DSA	CRYSTALS-Dilithium	lattices	signatures

• ML-KEM (Module-Lattice Key-Encapsulation Mechanism) replaces key exchange à la Diffie-Hellman or RSA. It is what establishes a shared secret at the start of a secure connection.
• ML-DSA (Module-Lattice Digital Signature Algorithm) replaces RSA/ECDSA signatures, to authenticate a message or a certificate.

A third standard, SLH-DSA (based on hash functions, formerly SPHINCS+), provides a backup signature resting on a different assumption, as a precaution.

Hybrid deployment

We do not switch over abruptly. During the transition, we deploy in hybrid mode: we combine a proven classical algorithm and a recent post-quantum algorithm.

Échange de clés hybride
-----------------------
   secret_classique   (ex : ECDH)
        +                          --> clé de session finale
   secret_postquantique (ML-KEM)

The reasoning is cautious: the final key is broken only if both building blocks fall. If ML-KEM turned out to have an unexpected flaw, the classical part still protects; and if a quantum computer breaks the classical part, ML-KEM holds. The securities add up.

Where does deployment stand?

Browsers and large platforms have started enabling post-quantum hybrid key exchange for web traffic. The migration of signatures and certificates, which is heavier, follows gradually.

In summary

NIST ran a competition from 2016 to 2024 and published in 2024 the first post-quantum standards: ML-KEM (based on Kyber) for key exchange and ML-DSA (based on Dilithium) for signatures, both derived from lattices. Deployment is done in hybrid mode, combining classical and post-quantum to stack the guarantees during the transition.