The Root Of Trust
All posts

NIST PQC Algorithms, Explained

September 2026 · 6 minute read

You've probably seen the names Kyber, Dilithium, or SPHINCS+ somewhere, or maybe ML-KEM and ML-DSA, and wondered what they actually are. Here's the short version: in 2024, the U.S. government's standards body, NIST, picked out a new set of encryption algorithms built to survive quantum computers. This post walks through what each one does, in plain terms — no math required.

Why we even need new algorithms

RSA and ECC have stayed secure for decades because they're built on math problems that are painfully slow for a classical computer to undo — RSA relies on how hard it is to find the prime factors of a huge number, and ECC relies on a similarly one-way problem on an elliptic curve. The catch is that a powerful enough quantum computer wouldn't be stuck the same way. Both of those problems turn out to have exactly the kind of hidden structure that a quantum algorithm, called Shor's algorithm, is built to exploit. That computer doesn't exist yet — no machine today is anywhere close to the scale needed. But the estimates for how big it would need to be have been dropping fast: a few years ago, experts thought breaking RSA-2048 would take around 20 million physical qubits, and recent 2026 research has pushed that estimate down to under a million. The bar keeps getting lower, even before the actual hardware catches up.

And here's the uncomfortable part: someone could be collecting encrypted data right now, and just sitting on it, waiting until a quantum computer is available to unlock it later. That's often called "harvest now, decrypt later," and it's the whole reason people are moving on this early, well before the actual threat is fully here.

So NIST ran a multi-year, public competition to find algorithms that don't have that weakness. Three of them officially became standards in August 2024.

What actually makes lattice math different

It's worth pausing on why lattice-based math (the foundation for two of the three new algorithms) resists quantum attacks when RSA and ECC don't, because it's not just "different math, hope for the best."

The quantum algorithm that threatens RSA and ECC, Shor's algorithm, has one specific superpower: it's extremely good at spotting hidden repeating patterns inside a problem. It turns out that both "find the prime factors" and "count the hops on a curve" have exactly that kind of clean, repeating structure buried inside them, which is precisely what lets a quantum computer shortcut its way to the answer.

Lattice problems don't have that same repeating structure. A lattice is a regularly spaced grid of points stretched across many dimensions, and the hard problem is something like: given a point that's close to the grid but not exactly on it, figure out which grid point it's actually near. Researchers have spent years trying to find a way to make Shor's algorithm, or anything like it, work against that kind of problem, and so far nobody has. Lattice problems do get a small speed-up from a different, much weaker quantum trick called Grover's algorithm, but that only cuts the effective security in half, which is why the new algorithms simply use bigger keys, rather than needing an entirely different design.

In short: RSA and ECC are breakable because their hard problems happen to hide a pattern quantum computers are built to find. Lattice-based problems don't hide that pattern, so quantum computers don't get their usual shortcut.

ML-KEM (you might know it as Kyber): for exchanging keys

Think of ML-KEM as doing one specific job: helping two people agree on a shared secret over a connection someone else might be listening to, without a quantum computer being able to figure out that secret later. It's the replacement for what RSA and a method called ECDH currently do when two systems need to set up a secure channel.

ML-DSA (formerly Dilithium): for signing things

If ML-KEM handles secrecy, ML-DSA handles proof — it's how a system proves "this message really did come from me and wasn't altered," the same job RSA and ECDSA signatures do today. It's built on the same family of lattice math as ML-KEM, so the two are natural partners.

SLH-DSA (formerly SPHINCS+): the backup plan

SLH-DSA takes a completely different approach than the other two. Instead of lattice math, it's built purely on hash functions, the same trusted building blocks behind things like SHA-2, which have been studied and battle-tested for decades.

Why bother with a third option? Because lattice-based math, while well-vetted, is still relatively new compared to hash functions. If someone ever found a weakness in the lattice approach that ML-KEM and ML-DSA rely on, it would be good to have something built on entirely different foundations as a fallback. The cost is that SLH-DSA is slower and produces much bigger signatures, so most systems will treat it as a backup option rather than the everyday choice.

The three, side by side

What this means if you work in payments

Payments systems use RSA and ECC in two different ways, and they're not equally urgent. Key transport — moving an encryption key securely from one system to another, like an HSM sending a key somewhere — is the more time-sensitive problem, since anyone intercepting that traffic today could crack it open later once quantum computers catch up. Signatures are a bit less pressing, since a forged signature is only a problem at the moment someone tries to use it, not years down the line.

Worth knowing: as of right now, the major payments standards — EMV, ISO 8583, and PCI PIN — haven't published official guidance on how to actually roll these algorithms out. The building blocks exist. The payments-specific playbook is still being written.

A few things people get wrong

The bigger picture

What's interesting about all this isn't really the math. It's that the entire industry is being asked to plan a defense against a threat that doesn't fully exist yet, on a timeline set by data that's already exposed today. That's an unusual position to be in, and it's exactly why the migration is starting now instead of later.