Post-Quantum Algorithm Explorer
Understand the NIST-standardised algorithms your organisation will need to adopt. Compare options by use case, maturity, and practical implications for your infrastructure.
Key Encapsulation Mechanisms (KEM)
KEMs are used for secure key exchange, establishing shared secrets between parties. ML-KEM replaces ECDH / RSA key exchange.
| Algorithm | Standard | Family | Status | Security Level | Public Key | Ciphertext | Performance |
|---|---|---|---|---|---|---|---|
| ML-KEM (Kyber) | FIPS 203 | Lattice | NIST Finalized | 1 | 800 B | 768 B | ~0.04 ms |
| 3 | 1184 B | 1088 B | ~0.06 ms | ||||
| 5 | 1568 B | 1568 B | ~0.08 ms | ||||
| HQC | NIST Round 4 | Code-based | NIST Round 4 | 1 | 2249 B | 4497 B | ~0.1 ms |
| 3 | 4522 B | 9042 B | ~0.2 ms | ||||
| 5 | 7245 B | 14469 B | ~0.4 ms | ||||
| BIKE | NIST Round 4 | Code-based | NIST Round 4 | 1 | 1541 B | 1573 B | ~0.1 ms |
| 3 | 3083 B | 3115 B | ~0.2 ms | ||||
| RSA | PKCS#1 / RFC 8017 | Integer Factorization | Quantum Vulnerable | 112-bit classical | 256 B | . | ~1 ms |
| 128-bit classical | 384 B | . | ~3 ms | ||||
| ~140-bit classical | 512 B | . | ~8 ms |
Digital Signature Algorithms
Digital signatures authenticate identity and data integrity. ML-DSA, SLH-DSA, and FN-DSA replace RSA / ECDSA signatures.
| Algorithm | Standard | Family | Status | Security Level | Public Key | Signature | Sign / Verify |
|---|---|---|---|---|---|---|---|
| ML-DSA (Dilithium) | FIPS 204 | Lattice | NIST Finalized | 2 | 1312 B | 2420 B | ~0.15 ms / ~0.05 ms |
| 3 | 1952 B | 3293 B | ~0.25 ms / ~0.08 ms | ||||
| 5 | 2592 B | 4595 B | ~0.38 ms / ~0.10 ms | ||||
| SLH-DSA (SPHINCS+) | FIPS 205 | Hash-based | NIST Finalized | 1 | 32 B | 7856 B | ~50 ms / ~3 ms |
| 1 | 32 B | 17088 B | ~3 ms / ~0.5 ms | ||||
| 5 | 64 B | 29792 B | ~200 ms / ~6 ms | ||||
| FN-DSA (Falcon) | FIPS 206 (Draft) | Lattice | NIST Finalizing | 1 | 897 B | 666 B | ~0.5 ms / ~0.05 ms |
| 5 | 1793 B | 1280 B | ~1 ms / ~0.10 ms | ||||
| RSA | PKCS#1 / RFC 8017 | Integer Factorization | Quantum Vulnerable | 112-bit classical | 256 B | 256 B | ~1 ms / ~0.03 ms |
| 128-bit classical | 384 B | 384 B | ~3 ms / ~0.05 ms | ||||
| ~140-bit classical | 512 B | 512 B | ~8 ms / ~0.08 ms | ||||
| ECDSA | FIPS 186-5 | Elliptic Curve | Quantum Vulnerable | 128-bit classical | 64 B | 64 B | ~0.05 ms / ~0.10 ms |
| 192-bit classical | 96 B | 96 B | ~0.15 ms / ~0.30 ms |
Algorithm Deep Dives
Detailed profiles for each algorithm: description, pros and cons, and recommended use cases.
ML-KEM (Kyber)
Module-Lattice-Based Key-Encapsulation Mechanism
The primary NIST-standardized key encapsulation mechanism based on the Module Learning With Errors (MLWE) problem. Used for secure key exchange in TLS, VPN, and other protocols.
Strengths
- Fast key generation and encapsulation
- Relatively small key and ciphertext sizes
- Well-studied security assumptions
- Strong industry adoption
Limitations
- Larger keys than classical ECDH (~30x)
- Newer math. less cryptanalysis history than RSA
ML-DSA (Dilithium)
Module-Lattice-Based Digital Signature Algorithm
The primary NIST-standardized digital signature algorithm based on the Module Learning With Errors problem. Designed for general-purpose digital signatures.
Strengths
- Fast signing and verification
- Balanced key/signature sizes
- Same mathematical family as ML-KEM (shared expertise)
- Strong security proofs
Limitations
- Larger signatures than classical ECDSA (~50x)
- Larger public keys than classical ECDSA (~40x)
SLH-DSA (SPHINCS+)
Stateless Hash-Based Digital Signature Algorithm
A conservative stateless hash-based signature scheme. Security relies solely on the well-understood security of hash functions, making it a hedge against lattice-based cryptanalysis.
Strengths
- Security based only on hash functions. extremely conservative
- Very small public keys (32-64 bytes)
- No structured mathematical assumptions to break
Limitations
- Very large signatures (8-30 KB)
- Slow signing (especially "small" variants)
- Not suitable for bandwidth-constrained applications
FN-DSA (Falcon)
FFT over NTRU-Lattice-Based Digital Signature Algorithm
A lattice-based signature scheme using NTRU lattices with FFT-based sampling. Offers the smallest signatures among lattice-based schemes but is more complex to implement.
Strengths
- Smallest signatures among lattice-based schemes
- Fast verification
- Compact for constrained environments
Limitations
- Complex implementation (FFT-based Gaussian sampling)
- Side-channel vulnerabilities require careful implementation
- Slower signing than ML-DSA
HQC
Hamming Quasi-Cyclic
A code-based KEM offering an alternative mathematical approach to ML-KEM. Provides diversity in case lattice-based assumptions are broken.
Strengths
- Different mathematical basis than lattice. algorithmic diversity
- Well-studied code-based assumptions
Limitations
- Much larger keys and ciphertexts than ML-KEM
- Slower performance
BIKE
Bit Flipping Key Encapsulation
A code-based KEM using quasi-cyclic MDPC codes. Offers compact keys compared to other code-based schemes.
Strengths
- Relatively compact keys for a code-based scheme
- Different assumption base than lattice
Limitations
- Decapsulation can have variable timing (potential side-channel)
- Less mature than ML-KEM
RSA
Rivest–Shamir–Adleman
The most widely deployed public-key algorithm. Security relies on the difficulty of factoring large integers. broken by Shor's algorithm on a quantum computer.
Strengths
- Universally supported
- Well-understood security
- Small signatures
Limitations
- BROKEN by quantum computers (Shor's algorithm)
- Larger keys than ECC
- Slower than ECC
ECDSA
Elliptic Curve Digital Signature Algorithm
Efficient digital signatures using elliptic curve mathematics. Widely used in TLS, Bitcoin, and code signing. Broken by Shor's algorithm.
Strengths
- Small keys and signatures
- Fast operations
- Widely deployed
Limitations
- BROKEN by quantum computers (Shor's algorithm)
What Should Your Team Adopt?
Strategic decision guide: match your infrastructure needs to the right algorithm.
TLS / VPN Key Exchange
You need a KEM to replace ECDH for establishing shared secrets.
Already adopted by Chrome, Firefox, Cloudflare, and AWS. Use hybrid (X25519 + ML-KEM) during transition.
Code Signing / Certificates
You need digital signatures for software distribution and PKI.
Good balance of key/signature size and performance. Use SLH-DSA as a conservative backup for root certificates.
IoT / Embedded Systems
Constrained devices with limited bandwidth and storage.
FN-DSA has the smallest signatures among lattice schemes. Careful implementation needed to avoid side channels.
Maximum Conservative Security
Applications where the cost of a break is catastrophic (nuclear, defense, long-lived secrets).
SLH-DSA relies only on hash function security. the most conservative assumption. Large signatures are acceptable for high-stakes use.