Fraunhofer Institute for Applied and Integrated Security Quantum-capable attackers threaten today’s dominant public-key schemes, such as RSA, (EC)DH, and (EC)DSA, because efficient quantum algorithms can efficiently solve the underlying mathematical problems.
Particularly critical is the "store now – decrypt later" scenario, in which attackers collect encrypted data today with the intention of decrypting it later.
Cryptography is deeply embedded in architectures, products, and supply chains. Cryptographic keys, certificates, and protocol parameters often persist for many years. Early action is therefore crucial to protect long-term data from subsequent disclosure.
Post-quantum cryptography (PQC) offers robust alternatives for protecting data, but its implementation requires a structured migration.
Current positions on PQC standardization and migration
Hybridization
Since PQC methods are relatively new and less well-researched, it may be advisable to combine them with classical cryptographic methods. In such a hybrid approach, security can be guaranteed even if one of the combined methods proves to be insecure.
In the EU, lattice-based cryptography is currently intended for use only in hybrid form. The European Cybersecurity Certification Group calls for its combination with classical, established methods. The BSI follows this approach in its technical guideline and requires the use of non-hash-based PQC methods in a hybrid form. Hash-based signatures such as SLH-DSA, as well as LMS and XMSS, can be used independently.
The National Institute of Standards and Technology (NIST) epermits standalone use for all recommended schemes and positions hybrid schemes as useful, but only as a temporary migration option.
The british National Cyber Security Centre (NCSC) ffollows this line and recommends hybrid schemes only as a transitional measure for the eventual transition to pure PQC schemes.
Recommended PQC schemes
There is broad consensus on the recommendation to use ML-KEM for key exchange and ML-DSA for digital signatures. Furthermore, SLH-DSA as well as the stateful hash-based signatures LMS and XMSS are recommended for specific use cases. The key difference among the various positions, however, lies in whether these methods may be used as standalone solutions or only in hybrid configurations today.
Signature Schemes
| Region | Recommended methods | Parameter notes | Hybrid Mandatory |
|---|---|---|---|
| EU | ML-DSA, SLH-DSA, as well as LMS and XMSS | ML-DSA-65 or ML-DSA-87. SLH-DSA according to FIPS205 in categories 3 and 5. | Yes, for ML-DSA |
| Germany | ML-DSA, SLH-DSA, as well as LMS and XMSS | ML-DSA-65 or ML-DSA-87. SLH-DSA according to FIPS205 in Categories 3 and 5. XMSS and LMS according to SP 800-208. | Yes, for ML-DSA |
| USA | ML-DSA, SLH-DSA, as well as LMS and XMSS | ML-DSA according to FIPS204. SLH-DSA according to FIPS205. LMS and XMSS according to SP 800-208. | No |
| United Kingdom | ML-DSA, SLH-DSA, as well as LMS and XMSS | ML-DSA according to FIPS204 (ML-DSA-65 recommended). SLH-DSA according to FIPS205. LMS and XMSS according to SP 800-208. | No |
Key exchange schemes
| Region | Recommended methods | Parameter notes | Hybrid Mandatory |
|---|---|---|---|
| EU | ML-KEM and conservative FrodoKEM | ML-KEM-768 or ML-KEM-1024. FrodoKEM-976 or FrodoKEM-1344. | Yes |
| Germany | ML-KEM as well as conservative FrodoKEM and Classic McEliece HQC as soon as standardized |
ML-KEM-768 or ML-KEM-1024. FrodoKEM-976 or FrodoKEM-1344. mceliece460896(f), mcelie-ce6688128(f), or mcelie-ce8192128(f). HQC according to NIST Categories 3 and 5. |
Yes |
| USA | ML-KEM | ML-KEM according to FIPS203. | No |
| United Kingdom | ML-KEM | ML-KEM according to FIPS203 (ML-KEM-768 recommended). | No |