Standards. Deadlines. Procurement signals.
What FIPS 203/204/205, CNSA 2.0, and CISA's product-category guidance mean for the operator who has to act on them.
The most volatile page in the section. The algorithm standards are stable — FIPS 203/204/205 will not change. The procurement-signal layer (CNSA 2.0 deadlines, CISA category list, NIST IR 8547 transition status, cryptanalytic research compression) moves fastest. This page is reviewed monthly; the version stamp and next-review triggers are below.
FIPS 203, 204, 205 at the operator level.
NIST's three finalized post-quantum standards divide cleanly by function. FIPS 203 specifies ML-KEM (the Module-Lattice Key Encapsulation Mechanism, derived from CRYSTALS-Kyber) for key establishment — the operation that protects TLS, VPN, SSH, and any session-setup handshake. FIPS 204 specifies ML-DSA (Module-Lattice Digital Signature Algorithm, derived from CRYSTALS-Dilithium) for general-purpose digital signatures — TLS certificates, JWTs, document signing. FIPS 205 specifies SLH-DSA (Stateless Hash-Based Digital Signature Algorithm, derived from SPHINCS+) for conservative long-lived signing — root CAs, firmware, code signing, long-lived trust anchors where algorithm diversity matters.
| Standard | Algorithm | Parameter sets | NSS mandate (CNSA 2.0) |
|---|---|---|---|
| FIPS 203 | ML-KEM | ML-KEM-512 · -768 · -1024 | ML-KEM-1024 |
| FIPS 204 | ML-DSA | ML-DSA-44 · -65 · -87 | ML-DSA-87 |
| FIPS 205 | SLH-DSA | 128s / 128f · 192s / 192f · 256s / 256f | (diversity option) |
Operational size table
| Algorithm | Public key | Ciphertext / Signature |
|---|---|---|
| RSA-2048 | 256 B | 256 B |
| ECDH P-256 | 32 B | 32 B |
| ECDSA P-256 | 64 B | 64 B |
| ML-KEM-768 | 1,184 B | 1,088 B |
| ML-KEM-1024 | 1,568 B | 1,568 B |
| ML-DSA-65 | 1,952 B | 3,293 B |
| ML-DSA-87 | 2,592 B | 4,595 B |
| SLH-DSA-128s | 32 B | 7,856 B |
The size delta is the operational story. ML-DSA-87 signatures are roughly 18× the size of an RSA-2048 signature; SLH-DSA signatures are 30×+. This is the root cause of the MTU, PKI chain, and firewall compatibility problems that dominate early deployment experience. See the IT Technicians briefing for the operator-level checklist before the change window opens.
CNSA 2.0 and the 2027 inflection.
The phased timeline tracked by the procurement and engineering community is CNSA 2.0's. Even organizations not bound by it as a federal mandate use it as the de facto vendor roadmap because that is what vendor product managers are scheduling against.
| Milestone | Window | Scope |
|---|---|---|
| PQC products widely available | Jan 2026 | Network equipment, browsers, TLS stacks |
| PQC preferred (CNSA 2.0) | Jan 2027 | All new NSS / critical-infrastructure acquisitions |
| Classical key establishment disallowed | 2030 | All NSS |
| Classical signatures disallowed | 2031 | All NSS |
| Full NIST deprecation horizon | 2035 | All FIPS-governed systems |
The companion policy stack: NSM-10 (May 2022) sets the 2035 horizon and directs federal PQC migration. OMB M-23-02 requires annual federal-agency inventory of quantum-vulnerable systems through 2035. The Quantum Computing Cybersecurity Preparedness Act (QCCPA, December 2022) gives statutory authority to OMB's mandates. Private-sector regulated industries should expect sector regulators to mirror these requirements within a one-to-three-year lag — financial services, healthcare, and critical infrastructure first.
What's moving. What to track.
Five signal sources warrant active monitoring. They move on different cadences; treat the monthly review as a chance to scan each one rather than wait for any single source to push.
Active signals to monitor
- CISA Product Categories. January 2026 baseline list of PQC-capable categories. Expect periodic additions and minor revisions. The list is the procurement-side reference.
- NIST IR 8547. The transition-timeline document. In initial public draft as of November 2024. Finalization will sharpen the deprecation calendar.
- NSA CNSA 2.0 FAQ. Active FAQ thread covering hybrid acceptance, parameter mandates, exemption posture. Watch the NIST PQC-Forum mailing list for revisions.
- Vendor GA cadence. Cisco, Palo Alto, Microsoft, AWS, Google, Apple are each releasing PQC support across product families on independent schedules. AWS KMS, Azure Key Vault, GCP Cloud KMS each expose hybrid TLS and PQC primitives unevenly across services.
- Cryptanalytic research compression. Periodic academic papers (recent Google / Caltech work as case study) revise the resource estimate for breaking RSA. None has shifted the operational planning calendar so far, but the trend is toward lower resource requirements.
Maintenance posture for this page
- Cadence. Monthly review of the timeline table and signals list.
- Triggers for an off-cycle revision. Any of: CISA category-list update, NIST IR 8547 finalization, NSA CNSA 2.0 FAQ revision, major-vendor PQC GA announcement, documented CRQC capability milestone.
- Versioning. Stamp the "Last reviewed" date and the page version on every revision. Tag content changes that affect a primary recommendation (date, parameter, deadline) in the page change log.