FIPS 203 and FIPS 204 explained: what NIST's PQ standards mean for procurement

The August 2024 finalisations

On 13 August 2024, NIST published FIPS 203, FIPS 204, and FIPS 205 — finalising the three post-quantum cryptography standards selected through its eight-year-long PQC competition. For procurement teams, the key change is that "post-quantum cryptography" is no longer an aspirational claim. It is now a formal standard with KAT vectors, test suites, and a published migration pathway.

FIPS 203 — ML-KEM (Key Encapsulation)

Standard: Module-Lattice-Based Key-Encapsulation Mechanism Standard. Formerly known as CRYSTALS-Kyber.

Purpose: Establishes a shared secret between two parties in a way that resists attack by quantum-capable adversaries. The post-quantum replacement for the key-encapsulation half of RSA, DH, and ECDH.

Parameter sets: ML-KEM-512, ML-KEM-768, ML-KEM-1024 — providing roughly 128, 192, and 256 bits of post-quantum security respectively.

Where it applies in storage: Wrapping the per-file data-encryption key. Anywhere RSA or ECC was used to wrap or transmit a symmetric key, ML-KEM is the post-quantum replacement.

Recommendation: Use ML-KEM-1024 for any data with a meaningful useful life (regulated records, archived backups, anything subject to "harvest-now-decrypt-later/" class="glossary-link" title="See glossary: harvest now, decrypt later">harvest now, decrypt later" risk). Cost is small; future-proofing is large.

FIPS 204 — ML-DSA (Digital Signatures)

Standard: Module-Lattice-Based Digital Signature Standard. Formerly known as CRYSTALS-Dilithium.

Purpose: Provides digital signatures that resist forgery by quantum-capable adversaries. The post-quantum replacement for RSA, DSA, and ECDSA signatures.

Parameter sets: ML-DSA-44, ML-DSA-65, ML-DSA-87 — providing roughly 128, 192, and 256 bits of security respectively.

Where it applies in storage: Audit-log signing, integrity certificates, compliance reports, anything where non-repudiation matters. Anywhere RSA or ECDSA was used to sign artefacts, ML-DSA is the post-quantum replacement.

Recommendation: Use ML-DSA-87 for high-value attestations (compliance reports, regulatory filings). Smaller parameter sets are appropriate for high-frequency operations like token signing.

FIPS 205 — SLH-DSA (Stateless Hash-Based Signatures)

Standard: Stateless Hash-Based Digital Signature Standard. Based on SPHINCS+.

Purpose: Backup/alternative post-quantum signature scheme based on hash functions rather than lattices.

Status: Useful for systems wary of relying solely on lattice problems. Larger signatures, slower performance, but the security foundation (hash functions) is conservative and well-understood.

Recommendation: For now, ML-DSA is the right default. SLH-DSA is the appropriate hedge for ultra-conservative or high-assurance contexts where the additional cost is acceptable.

What "PQ-ready" means in procurement terms

Until August 2024, "post-quantum" in vendor claims could mean anything from "we'll add it when standards are final" to "we implemented the round-3 candidate." Both Canada's Cyber Centre PQC guidance (updated 2025) and the NSA's CNSA 2.0 profile now reference the finalised FIPS standards specifically.

A vendor that claims PQ-readiness in 2026 should be able to answer:

• Which FIPS-finalised algorithm is in use? (ML-KEM-768? ML-KEM-1024? ML-DSA-65? ML-DSA-87?)
• Is it hybrid (PQ + classical) or pure PQ?
• Where in the architecture does it apply? (Key wrap? Signature? Both?)
• Is it in production for customer data, or only in a feature flag?
• Can the verification key for signatures be published for offline verification?

If a vendor cannot answer all five, the claim is marketing rather than implementation.

What SkyeConnex ships

SkyeConnex implements both halves of the PQ migration in production today:

• ML-KEM-1024 (FIPS 203) wraps the per-file data-encryption key on the Sovereign tier, in hybrid composition with AES Key Wrap (SP 800-38F). A quantum break alone is insufficient — AES is still the inner wrap.
• ML-DSA-87 (FIPS 204) co-signs every compliance report and integrity certificate alongside HMAC-SHA-256. The HMAC preserves online-verify compatibility; the ML-DSA signature delivers non-repudiation against quantum adversaries.

The issuer's ML-DSA-87 public key is published at /security — both as a SHA-256 fingerprint for pinning and as raw base64 for direct use with any FIPS 204 verifier (Python pqcrypto, Open Quantum Safe liboqs, AWS-LC).

The procurement test

Ask a prospective vendor to verify a signed report you generate from their own platform, entirely offline, using their published public key. SkyeConnex's customers can do this with three lines of Python and no network call. Most vendors cannot.

If your security team wants this capability, book a briefing. We will walk you through report generation and offline verification, live, in 45 minutes.

---

Published April 21, 2026 · Written by SkyeConnex Inc. · More from the SkyeConnex blog