PQC Standardisation Timeline

The journey from problem recognition to deployable quantum-safe standards has spanned nearly a decade. This timeline documents the key milestones in the NIST Post-Quantum Cryptography Standardisation Process.

2015 -- The Starting Signal

• August 2015 -- The NSA publishes CNSA Suite guidance, announcing plans to transition to quantum-resistant algorithms. This signals that the U.S. government considers the quantum threat operationally real.

2016 -- NIST Launches the Competition

• December 2016 -- NIST formally calls for proposals for post-quantum public-key cryptographic algorithms. The goal: identify replacements for RSA, ECDSA, and Diffie-Hellman key exchange.
• 82 submissions are received across four categories: lattice-based, code-based, hash-based, and multivariate.

2017 -- First Round Begins

• December 2017 -- NIST announces 69 complete and proper submissions accepted into Round 1.
• Public review and cryptanalysis begins. The community scrutinises each candidate for correctness, performance, and implementation security.

2019 -- Round 2 Narrowing

• January 2019 -- 26 algorithms advance to Round 2 (17 encryption/KEM, 9 signature schemes).
• Eliminated candidates include those with broken security or impractical performance.
• Side-channel analysis and implementation studies intensify.

2020 -- Round 3 Finalists

• July 2020 -- NIST selects 7 finalists and 8 alternates for Round 3:
  • KEM Finalists: CRYSTALS-Kyber, NTRU, SABER, Classic McEliece
  • Signature Finalists: CRYSTALS-Dilithium, FALCON, Rainbow
  • Alternates: BIKE, FrodoKEM, HQC, NTRU Prime, SIKE, GeMSS, Picnic, SPHINCS+

2022 -- Initial Selections

• July 2022 -- NIST announces the first algorithms selected for standardisation:
  • CRYSTALS-Kyber (lattice KEM) -- selected as the primary key encapsulation mechanism
  • CRYSTALS-Dilithium (lattice signature) -- selected as the primary digital signature
  • FALCON (lattice signature) -- selected for cases requiring smaller signatures
  • SPHINCS+ (hash-based signature) -- selected as a conservative, well-understood alternative
• SIKE is broken -- a classical attack is found (August 2022), eliminating it entirely.
• Rainbow is broken earlier in February 2022.

2023 -- Draft Standards Published

• August 2023 -- NIST releases draft FIPS standards for public comment:
  • FIPS 203 (draft) -- ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), based on Kyber
  • FIPS 204 (draft) -- ML-DSA (Module-Lattice-Based Digital Signature Algorithm), based on Dilithium
  • FIPS 205 (draft) -- SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), based on SPHINCS+

Note: NIST renames the algorithms during standardisation to reflect their mathematical basis rather than competition codenames.

2024 -- Final Standards Released

• 13 August 2024 -- NIST officially publishes the first three PQC standards:
  • FIPS 203 -- ML-KEM (key encapsulation)
  • FIPS 204 -- ML-DSA (digital signature)
  • FIPS 205 -- SLH-DSA (hash-based signature)
• These are now the mandatory replacements for quantum-vulnerable algorithms in U.S. federal systems.
• November 2024 -- NIST releases a draft standard for FN-DSA (based on FALCON), expected to be finalised as FIPS 206.

2025 -- Ecosystem Adoption

• .NET 10 (November 2025) ships native System.Security.Cryptography support for ML-KEM, ML-DSA, and SLH-DSA.
• OpenSSL 3.5 includes post-quantum algorithm providers.
• Chrome/BoringSSL has been shipping ML-KEM hybrid key exchange (X25519MLKEM768) since early 2024 in TLS.
• Signal protocol upgraded to PQXDH (using ML-KEM for forward secrecy).
• Apple iMessage PQ3 protocol deployed across iOS 17.4+ using ML-KEM.

2025-2035 -- Migration Deadlines

Fourth-Round Candidates (Still Under Evaluation)

Tip: HQC was selected for standardisation in March 2025, expected to become FIPS 207 -- an additional KEM based on code-based cryptography rather than lattices, providing algorithm diversity.

Key Takeaways

1. The standardisation process took 8 years from call to final standard.
2. Multiple finalist algorithms were broken during the process (Rainbow, SIKE), validating the need for extended public cryptanalysis.
3. Lattice-based schemes dominate the finalists (ML-KEM, ML-DSA, FN-DSA), while hash-based (SLH-DSA) and code-based (HQC) provide diversity.
4. Real-world deployment is already happening (browsers, messaging apps, operating systems) ahead of regulatory deadlines.
5. The "harvest now, decrypt later" threat means organisations should begin migration planning today, not wait for mandate enforcement.