Cryptography

ML-KEM and ML-DSA: a field guide to FIPS 203 and 204

NIST finalized its first post-quantum standards in August 2024. Here is what they are, how big they are, and how to adopt them.

2026-10-26

In August 2024 NIST published three post-quantum standards: FIPS 203 (ML-KEM, from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+).

ML-KEM: key encapsulation

ML-KEM replaces ECDH-style key agreement. ML-KEM-768, the common default, has a 1,184-byte public key and a 1,088-byte ciphertext, versus 32 bytes for X25519.

ML-DSA: signatures

ML-DSA replaces ECDSA and EdDSA. ML-DSA-65 has a 1,952-byte public key and a 3,309-byte signature, versus 33 and about 72 bytes for secp256k1 ECDSA. Size, not speed, is the main cost.

Adoption guidance

Deploy hybrid key exchange (classical + ML-KEM) first; it protects against harvest-now-decrypt-later with no loss of classical security.
Inventory where signatures are verified and stored; larger signatures affect bandwidth, storage, and protocol limits.
Design for crypto-agility so algorithms and parameter sets can change without redesigning the system.

Try both schemes and compare sizes with our pqc-playground package.