What FIPS 203 contains
FIPS stands for Federal Information Processing Standard, a standard NIST issues for US federal computer systems. FIPS 203 applies to federal agencies and their contractors, and NIST states that private and commercial organizations are free to adopt it too.1 The document is the full recipe for ML-KEM, an algorithm derived from CRYSTALS-Kyber.1 It covers:
- Three algorithms: ML-KEM.KeyGen makes a key pair, ML-KEM.Encaps creates a shared secret and a ciphertext from a public encapsulation key, and ML-KEM.Decaps recovers the same secret with the private decapsulation key.
- Three parameter sets: ML-KEM-512, ML-KEM-768 and ML-KEM-1024, in order of increasing security strength.
- Required checks: encapsulation and decapsulation must check their inputs, so a malformed key is rejected instead of quietly used.
- Randomness rules: ML-KEM-512, ML-KEM-768 and ML-KEM-1024 need a random number generator with at least 128, 192 and 256 bits of strength.
- Differences from Kyber: an appendix lists every change made during standardization.
| Parameter set | NIST category | Encapsulation key | Decapsulation key | Ciphertext |
|---|---|---|---|---|
| ML-KEM-512 | 1 | 800 bytes | 1,632 bytes | 768 bytes |
| ML-KEM-768 | 3 | 1,184 bytes | 2,400 bytes | 1,088 bytes |
| ML-KEM-1024 | 5 | 1,568 bytes | 3,168 bytes | 1,568 bytes |
On choosing between them, the standard is direct: when first setting up protection for data, the strongest possible parameter set should be used, which lowers the chance of a costly move to a larger set later.1
FIPS 203, 204 and 205
NIST released three post-quantum standards on the same day, each for a different job.123
| Standard | Algorithm | Job | Based on |
|---|---|---|---|
| FIPS 203 | ML-KEM | Agreeing on a secret key | CRYSTALS-Kyber |
| FIPS 204 | ML-DSA | Digital signatures | CRYSTALS-Dilithium |
| FIPS 205 | SLH-DSA | Digital signatures from hash functions | SPHINCS+ |
In March 2025, NIST also selected HQC as a backup key-encapsulation algorithm built on different math from ML-KEM, so there is a second option if a weakness in lattices ever turns up.4
Why FIPS 203 matters
Key exchange is the part of today’s encryption most exposed to quantum computers. Data protected by RSA or elliptic-curve key exchange can be recorded now and opened later, once a large enough quantum computer exists. FIPS 203 gives the industry one agreed replacement. NIST’s draft transition plan proposes deprecating the weaker RSA and elliptic-curve sizes after 2030 and disallowing both after 2035.5 That is why web browsers, SSH and crypto libraries such as OpenSSL now ship ML-KEM, usually paired with a classical key exchange such as X25519.
FIPS 203 in Secria
Secria uses ML-KEM-1024, the strongest of the three FIPS 203 parameter sets, together with X25519 on every plan. Secria Mail seals every message in your mailbox with it, free plan included, and Secria VPN mixes an ML-KEM-1024 protected key into every WireGuard session. VPN servers prove who they are with ML-DSA from FIPS 204, and releases are signed with SLH-DSA from FIPS 205.
Related terms
Sources
- NIST, FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (August 2024).
- NIST, FIPS 204: Module-Lattice-Based Digital Signature Standard (August 2024).
- NIST, FIPS 205: Stateless Hash-Based Digital Signature Standard (August 2024).
- NIST, NIST selects HQC as fifth algorithm for post-quantum encryption (March 2025).
- NIST, IR 8547 (initial public draft): Transition to Post-Quantum Cryptography Standards (November 2024).
Checked October 2026. Secria facts are from our Mail and VPN pages and the whitepaper.
Questions about FIPS 203
Is FIPS 203 the same as ML-KEM?
FIPS 203 is the document and ML-KEM is the algorithm it defines. People often use the two names for the same thing.
Is FIPS 203 the same as Kyber?
ML-KEM in FIPS 203 is the standardized version of CRYSTALS-Kyber. NIST made small changes during standardization, so ML-KEM and early Kyber drafts don’t interoperate, but the design is the same.
What is the difference between FIPS 203, 204 and 205?
FIPS 203 defines ML-KEM for agreeing on secret keys. FIPS 204 defines ML-DSA and FIPS 205 defines SLH-DSA, both for digital signatures. Together they replace RSA and elliptic-curve cryptography for a world with quantum computers.
When was FIPS 203 published?
NIST published FIPS 203 on August 13, 2024, and it took effect immediately on publication, together with FIPS 204 and FIPS 205.