NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)

Architect cryptographic agility per NIST SP 1800-38 + ISO/IEC 24759 covering: pluggable cryptographic providers + algorithm abstraction layers + key lifecycle management + protocol negotiation (TLS 1.3 PQC hybrid drafts + IETF LAMPS WG) + KMIP + PKCS#11 + HSM management APIs. Implement hybrid + composite modes per ETSI TR 103 619 + IETF drafts where appropriate: ECDH+ML-KEM + ECDSA+ML-DSA + ECDSA+SLH-DSA. Use NCC Group HAPKIDO + Cloudflare X25519MLKEM768 + AWS LibCrypto Hybrid + Google BoringSSL + OpenSSL 3.5+ + wolfSSL + Apple Quantum Resistant iMessage (PQ3) deployments as references.

• Crypto-agility architecture
• Hybrid/composite mode strategy
• Protocol negotiation
• Reference implementation deployments
• KMIP/PKCS#11 integration

• No agility architecture
• No hybrid strategy
• Missing protocol updates
• No reference deployments

Implement FIPS 203 ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) based on CRYSTALS-Kyber for key establishment. Use approved parameter sets: ML-KEM-512 (NIST security level 1, 128-bit equivalent) + ML-KEM-768 (level 3, 192-bit) + ML-KEM-1024 (level 5, 256-bit). Implement key generation (KeyGen) + encapsulation (Encaps) + decapsulation (Decaps) per FIPS 203 Sections 5.1 + 5.2 + 5.3. Apply implementation requirements per FIPS 203 Section 6 including correct sampling + rejection sampling + constant-time arithmetic + module-LWE assumptions.

• Parameter set selection rationale
• KeyGen + Encaps + Decaps implementation
• Constant-time arithmetic
• CAVP test vector validation

• Wrong parameter set
• Non-constant-time
• No CAVP validation

Implement FIPS 204 ML-DSA (Module-Lattice-Based Digital Signature Algorithm) based on CRYSTALS-Dilithium for digital signatures + authentication + non-repudiation. Use approved parameter sets: ML-DSA-44 (NIST level 2) + ML-DSA-65 (level 3) + ML-DSA-87 (level 5). Implement key generation + signature generation (Sign) + signature verification (Verify) per FIPS 204 Sections 5.1 + 5.2 + 5.3. Apply pre-hashing and domain separation per FIPS 204 Section 6 for HashML-DSA variant (recommended for general-purpose signing with pre-computed hash).

• Parameter set selection
• Sign + Verify implementation
• Pre-hashing variant configuration
• CAVP test vector validation

• Wrong parameter set
• Missing pre-hashing
• No CAVP validation

Implement FIPS 205 SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) based on SPHINCS+ for long-term signatures + use cases requiring cryptographic agility independent of lattice assumptions. Use approved parameter sets covering SLH-DSA-SHA2 + SLH-DSA-SHAKE with small (128s/192s/256s) and fast (128f/192f/256f) variants providing trade-off between signature size and signing speed. Implement key generation + signature generation + signature verification per FIPS 205 Sections 5.1 + 5.2 + 5.3. Apply hash function instantiations per Section 6 (SHA2 + SHAKE). Use SLH-DSA for code signing + firmware signing + long-archived documents requiring 50+ year signature longevity.

• Parameter set selection (s/f trade-off)
• Sign + Verify implementation
• Hash function configuration
• Code/firmware signing deployment
• CAVP test vector validation

• Wrong parameter set
• Performance issues
• No long-term use case mapping
• No CAVP validation

Apply implementation requirements covering: (1) cryptographically secure random number generation per NIST SP 800-90A/B/C + entropy sources + true random number generators (TRNGs) for KeyGen + (2) side-channel attack resistance per ISO/IEC 17825 + TVLA + DPA/SPA + EM + timing attacks + fault injection + (3) key management per NIST SP 800-57 + NIST SP 800-152 + key lifecycle (generation + storage + distribution + rotation + revocation + archive + destruction) + (4) operations covering performance monitoring + bandwidth allocation + (5) incident response for cryptographic failures including algorithm break + key compromise + emergency rotation. Conduct cryptographic governance + vendor engagement + training and awareness for engineering + security + procurement teams.

• RNG NIST SP 800-90A compliance
• Side-channel test results (TVLA)
• Key management procedures
• Performance dashboard
• Crypto IR playbook
• Training records

• Weak RNG
• No side-channel testing
• No key management
• No crypto IR plan

Establish comprehensive cryptographic inventory per NIST SP 1800-38 covering: algorithms in use + key sizes + storage location + system dependencies + protocol bindings (TLS/IPsec/SSH/PKI/HSMs) + applications + microservices + IoT/OT devices. Develop PQC migration roadmap per CNSA 2.0 timeline (2025 transition for new procurements + 2030 software/firmware/services + 2031 NSS networks + 2033 NSS endpoints + 2035 full transition) + White House M-22-09 federal civilian deadlines + ENISA recommendations + NIST SP 800-208 stateful HBS for current use. Prioritise high-risk systems: long-lived encrypted data + harvest-now-decrypt-later (HNDL) threat + root CAs + identity certificates.

• Crypto inventory per NIST SP 1800-38
• Migration roadmap with timeline
• HNDL risk assessment
• Annual roadmap review
• CNSA 2.0 alignment

• No inventory
• No roadmap
• No HNDL assessment
• Misaligned with CNSA 2.0

Adopt NIST Post-Quantum Cryptography Standards published 13 August 2024 (FIPS 203 + FIPS 204 + FIPS 205) to address the threat of cryptographically relevant quantum computers (CRQCs) capable of breaking RSA + ECC + DH by 2030-2040 per NSA + NCSC + CSIS estimates. Maintain awareness of mathematical foundations: lattice-based (Module-LWE for ML-KEM and ML-DSA) + hash-based (SLH-DSA) + forthcoming code-based (HQC selected March 2025) + forthcoming Falcon (FN-DSA FIPS 206). Reference NIST PQC project initiated 2016 + Rounds 1-4 (2017-2022) + draft FIPS 203/204/205 (August 2023) + final standards (August 2024). Coordinate with NSA CNSA 2.0 + UK NCSC + BSI TR-02102 + Japan CRYPTREC + ETSI TC-CYBER QSC.

• Quantum threat assessment
• FIPS 203/204/205 adoption record
• CNSA 2.0 alignment
• International standards cross-walk

• No quantum threat assessment
• Missing FIPS adoption
• No CNSA 2.0 alignment

Deploy FIPS 140-3 validated cryptographic modules (NIST CMVP) supporting ML-KEM + ML-DSA + SLH-DSA. Test against NIST CAVP (Cryptographic Algorithm Validation Program) test vectors. Verify HSM readiness for PQC including Thales Luna 7 PQC + Entrust nShield PQC + Utimaco SecurityServer + AWS CloudHSM PQC + Microsoft Azure Managed HSM PQC. Test protocol integration with TLS 1.3 (RFC 8446 + draft-ietf-tls-hybrid-design) + SSH (draft-josefsson-ntru-ssh) + IKE/IPsec + S/MIME + PKI. Address performance and bandwidth impact (ML-KEM-768 public key 1184 bytes + ML-DSA-65 signature 3293 bytes + SLH-DSA signatures 7-49 KB).

• FIPS 140-3 validated modules
• CAVP test vectors
• HSM PQC capability
• Protocol integration test reports
• Performance benchmarks

• No FIPS validation
• Missing CAVP
• No HSM PQC
• No protocol testing