NIST Finalizes Two Post-Quantum Signature Standards Ahead of Federal Migration

The National Institute of Standards and Technology (NIST) has finalized two post-quantum digital-signature standards: ML-DSA (FIPS 204) and SLH-DSA (FIPS 205). Both became final on August 13, 2024, according to the supplied source. As of November 10, 2026, they are the two completed post-quantum signature standards identified for organizations seeking a standardized option. FN-DSA, derived from Falcon, remains in development without a public draft, while nine other candidates are being considered in an additional evaluation process. This leaves agencies and contractors with usable standards for current planning, but an evolving standards landscape for longer-term architecture decisions.

The distinction between the two finalized algorithms matters to system owners and vendors preparing technical documentation. The source describes ML-DSA, derived from CRYSTALS-Dilithium, as a general-purpose option and SLH-DSA, derived from SPHINCS+, as a conservative alternative based on hash functions rather than lattice assumptions. The standards offer agencies a defined starting point for requirements, product assessments, and migration roadmaps. At the same time, the source cautions that the signature field remains less settled than key establishment: one standard is still pending and additional designs are under evaluation. It does not provide verified, cross-source benchmark numbers for the candidates or list prices for the algorithms, so procurement comparisons should avoid treating unsupported performance or cost estimates as established facts.

The federal timeline adds urgency to the planning work. The source says the final NIST IR 8547 roadmap, published October 27, 2026, ties high-value federal systems to December 31, 2030 for key establishment and December 31, 2031 for digital signatures under Executive Order 14412. The supplied signal therefore gives vendors about five years from its publication date to prepare for the digital-signature target. Contractors supporting software signing, firmware, releases, certificates, and documents may need to identify where cryptographic signatures are used, assess whether current products support ML-DSA or SLH-DSA, and explain how those products can accommodate future algorithm changes. The source identifies no specific solicitation, contract value, or procurement contact; this is a standards and transition-planning signal rather than a discrete buying opportunity.

For GovCon suppliers, the practical opportunity is to make readiness verifiable rather than rely on broad claims of “quantum-safe” capability. Product and service teams can maintain evidence of standards support, identify dependencies across signing workflows, and describe implementation and upgrade paths in language procurement and cybersecurity reviewers can evaluate. Agencies can use the finalized standards to inform technical requirements while keeping transition plans adaptable as NIST’s evaluation proceeds. The source also quotes Dustin Moody, identified as head of NIST’s post-quantum cryptography project at the time, emphasizing contingency planning: “As we advance our understanding of future quantum computers and adapt to emerging cryptanalysis techniques, it’s essential to have a fallback in case ML-KEM proves to be vulnerable.” The quote concerns key establishment, but underscores a broader procurement consideration: standards readiness should include resilience and flexibility, not just a one-time algorithm selection.

• ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) are the two finalized post-quantum signature standards identified in the source.
• Both standards became final on August 13, 2024; ML-DSA is derived from CRYSTALS-Dilithium and SLH-DSA from SPHINCS+.
• FN-DSA, the Falcon-derived planned third option, has no public draft, and the source reports no confirmed publication date.
• NIST named nine candidates for a third evaluation round on May 14, 2026; their evaluation means additional options may emerge, but none should be treated as finalized on this record.
• The source reports a federal target of December 31, 2031 for digital-signature migration and December 31, 2030 for key establishment in high-value systems.
• Suppliers should document support for ML-DSA and SLH-DSA, algorithm agility, relevant product dependencies, and upgrade paths for agency review.
• Procurement teams can incorporate standards status and transition planning into technical requirements without assuming that every candidate has verified benchmark or pricing data.
• No solicitation, contract value, procurement contact, or named vendor is identified; the signal is relevant to cybersecurity product and service planning rather than a specific award or bid.