첨단 기술

ML-KEM establishes a shared secret; ML-DSA and SLH-DSA sign data. These functions serve different needs. The 18 parameter sets below come from the three final FIPS standards published on 13 August 2024. Use them to prepare inventories and capacity tests without treating an algorithm name as proof of a secure system.

Data and publication status pages checked on 2026-10-22.

ML-KEM · Establish a secret

1. The recipient publishes an encapsulation key.
2. The sender creates a ciphertext and shared secret, then sends the ciphertext.
3. The recipient recovers the secret using a decapsulation key.

Peer authentication and use of the secret depend on the complete protocol.

ML-DSA / SLH-DSA · Sign

1. The signer protects a private key and distributes a public key.
2. The signer signs data and sends the data with its signature.
3. The verifier checks the signature using the trusted public key.

A signature alone does not encrypt the signed content.

For ML-KEM, the public and private keys are used for encapsulation and decapsulation respectively; column five is the ciphertext. For both DSA families, the keys are used for verification and signing; column five is the signature. A dash means not applicable. NIST categories are neither quality ratings nor key lengths in bits.

Sizes refer to the raw encodings defined by the standards. A private key stored as a seed may occupy less space than the full encoding shown here. Certificates, containers, Base64, protocol headers and protected storage add their own bytes. In SLH-DSA, ‘s’ favours smaller signatures and ‘f’ faster signing; SHA2 and SHAKE variants share sizes for each variant, rather than the same hash instantiation.

Estimate a volume of cryptographic data

Choose a parameter set and object count. The calculation adds raw public sizes only: one KEM ciphertext or signature per object, with a public key sent once or repeated for every object. Private keys and shared secrets are excluded from the modelled transfer.

A numerical example for planning a test

For 1,000 ML-KEM-768 objects with a public key for every object: 1,000 × (1,184 + 1,088) = 2,272,000 raw bytes. With one public key for the whole batch: 1,184 + 1,000 × 1,088 = 1,089,184 bytes. This is an illustrative transport assumption, not a service or protocol measurement.

This volume model measures neither computation time, throughput, TLS latency nor security. The single-key mode assumes the same recipient or verifier can reuse that key under the chosen protocol. Check this assumption, key rotation and size limits in your environment. This tool sends no content, keys or entered data.

What evidence should a pilot require?

Decision questions

Does ML-KEM replace a signature?

No. Encapsulation establishes a shared secret. Signatures support checks of data integrity and origin under the chosen trust mechanism. A project may need to migrate these two functions separately.

Is the smallest object the best choice?

Size addresses one capacity constraint. Selection must also consider security requirements, maintained implementations, compatibility and test results. The comparison does not rank algorithms.

Is a product described as ‘FIPS 203’ automatically certified?

A standard reference identifies an algorithm specification. Request separate evidence of any claimed conformity or validation, its exact scope, the module version and the configuration assessed.

Why check publication status pages as well as the standard?

NIST status pages identify potential updates: notes dated 17 November 2025 for FIPS 203 and 31 July 2026 for FIPS 204 at this review. Ask suppliers which corrections their release incorporates.

Value provenance and freshness limits

Links lead to official publication notices and histories. Sizes come from the tables identified below; SLH-DSA private key sizes are calculated using the 4n rule in §3.1. Scope is limited to parameter sets in FIPS 203–205: this is not a catalogue of all post-quantum research, proposals or protocol profiles.

• NIST FIPS 203 · ML-KEM · §8, tables 2–3; §8 security categories
  Standard publication : 2024-08-13 · Potential update note : 2025-11-17
• NIST FIPS 204 · ML-DSA · §4, tables 1–2
  Standard publication : 2024-08-13 · Potential update note : 2026-07-31
• NIST FIPS 205 · SLH-DSA · §11, table 2; §3.1: private key = 4n bytes
  Standard publication : 2024-08-13