Why Track Status Separately From the Algorithms Themselves
Post-quantum cryptography is standardizing in waves, not all at once. NIST finalized its first three algorithms — ML-KEM, ML-DSA and SLH-DSA — in August 2024 after an eight-year public evaluation process. Everything after that point is still moving: HQC was picked as a second, mathematically distinct key encapsulation mechanism in March 2025, Falcon's signature standard is being finalized as FIPS 206, and NIST is still running an entirely separate evaluation round for additional signature schemes. A procurement document or security policy that says "we support all NIST PQC algorithms" without distinguishing these stages is making a claim that can't actually be verified yet.
What Each Entry Means for Migration Planning
| Algorithm | Use it in production today? | Why |
|---|---|---|
| ML-KEM / ML-DSA / SLH-DSA | Yes | Final FIPS text, implementations available in current crypto libraries |
| HQC | Not yet | Selected as a hedge against a future lattice break, but the standard text itself isn't published |
| FN-DSA (Falcon) | Not yet | Useful where signature size matters (e.g. bandwidth-constrained messaging), but implementation guidance is still being finalized |
| Round 2 signature candidates | No | Under active evaluation — may be eliminated in later rounds |
Try the finalized algorithms live: Kyber (ML-KEM), Dilithium (ML-DSA), and SPHINCS+ (SLH-DSA). Or compare them side by side in the Algorithm Comparison tool.