Post Quantum Algorithms and FIPS 140-3 Primer

02 Sep 2026

Understanding Post-quantum Cryptography, Approved Algorithms, and FIPS 140-3 Validation Requirements

What is Quantum Computing?

Quantum computing is a field of computing that uses principles of quantum mechanics to perform calculations in ways that classical computers cannot.

Quantum mechanics is a branch of physics that deals with the behavior of particles at the smallest scales, such as atoms and subatomic particles like electrons and photons.

While classical computers use bits as the smallest unit of data (which can be either 0 or 1), quantum computers use quantum bits, or qubits.

A qubit can exist in multiple states simultaneously. This means that, unlike a classical bit, which is either 0 or 1, a qubit can be both 0 and 1 at the same time, allowing quantum computers to process many possibilities simultaneously.

What is Post-quantum Cryptography (PQC)?

Put simply, it is cryptography that is intended to be secure against a cryptanalytic attack by a quantum computer.

What type of Cryptography Does each of these PQC Algorithms Follow?

Lattice-based cryptography: Lattice-based cryptography is a type of cryptographic system that relies on the mathematical properties of lattices (grids of points in a multi-dimensional space) for security, offering potential resistance to quantum computer attacks.

Hash-based cryptography: It's a method that constructs cryptographic algorithms, particularly digital signatures, based on the security properties of cryptographic hash functions.

PQC and FIPS 140-3

In August of 2024, the National Institute of Standards and Technology (NIST) published the FIPS 203, 204 and 205 standards and the Cryptographic Module Validation Program (CMVP) updated the IG 10.3.A, to approve the usage of the same in FIPS 140-3 validated modules.

FIPS 203 and 204 are the Lattice-Based Key Encapsulation and Digital Signature standards respectively, FIPS 205 is a stateless hash-based digital signature standard.

Approved Algorithms – FIPS 203, 204 and 205

The following algorithms per FIPS 203, 204 and 205 are deemed approved and can be tested and certified under the Cryptographic Algorithm Validation Program (CAVP):

Stateless Hash-Based Signatures

• SLH-DSA keyGen
• SLH-DSA sigGen
• SLH-DSA sigVer

Parameter Sets:

• SLH-DSA-SHA2-128s, SLH-DSA-SHAKE-128s,
• SLH-DSA-SHA2-128f, SLH-DSA-SHAKE-128f
• SLH-DSA-SHA2-192s, SLH-DSA-SHAKE-192s
• SLH-DSA-SHA2-192f, SLH-DSA-SHAKE-192f
• SLH-DSA-SHA2-256s, SLH-DSA-SHAKE-256s
• SLH-DSA-SHA2-256f, SLH-DSA-SHAKE-256f

Module-Lattice Algorithms

• ML-DSA keyGen
• ML-DSA sigGen
• ML-DSA sigVer

Parameter sets: "ML-DSA-44", "ML-DSA-65", "ML-DSA-87"

• ML-KEM keyGen
• ML-KEM encapsulation and decapsulation

Parameter sets: "ML-KEM-512", "ML-KEM-768", "ML-KEM-1024"

FIPS 140-3 Self-Testing Requirements

FIPS 203

• A CAST corresponding to each function/mode (encapsulation/decapsulation/key generation) supported by the module shall be implemented as follows:
  • ML-KEM encapsulation CAST
  • ML-KEM decapsulation CAST
  • ML-KEM key generation CAST
• CASTs shall be performed on at least one parameter set: ML-KEM-512/768/1024.
• The ML-KEM decapsulation CASTs shall cover both the implicit rejection and (unnamed non-rejection paths). In implicit rejection, the value of the shared secret is changed to a hash of the ciphertext together with the random value z stored in the ML-KEM secret key.
• IG 10.3.A Additional Comment 1: For key pairs generated for use with approved KEMs in FIPS 203, the pair-wise consistency test (PCT) (described in the ISO/IEC 24759 TE10.35.01) shall consist of applying the encapsulation key ek to encapsulate a shared secret K leading to ciphertext c, and then applying decapsulation key dk to retrieve the same shared secret K. The PCT passes if the two shared secret K values are equal. The PCT shall be performed either when keys are generated/imported, prior to the first exportation, or prior to the first operational use (if not exported before the first use).

FIPS 204

A CAST corresponding to each function/mode (signature generation/signature verification/key generation) supported by the module shall be implemented as follows:

• ML-DSA Signature generation CAST
• ML-DSA Signature verification CAST
• ML-DSA Key Generation CAST
• CASTs shall be performed on at least one parameter set: ML-DSA-44/65/87.

The ML-DSA digital signature generation CASTs must cover all applicable rejection sampling paths. Essentially, the main part of the signing algorithm consists of a rejection sampling loop in which each iteration of the loop either produces a valid signature or an invalid signature whose release would leak information about the private key. The loop is repeated until a valid signature is produced, which can then be encoded as a byte string and output.

If both pure ML-DSA signature generation and pre-hash ML-DSA signature generation (Section 5.4 and Algorithm 4 in FIPS 204) are implemented and they both share the same underlying cryptographic implementations, a CAST on either one of them is sufficient to meet the CAST requirements for both. Likewise for ML-DSA signature verification and pre-hash ML-DSA signature verification, a CAST on either one of them is sufficient.

For approved algorithms from FIPS 204, if at the time a pair-wise consistency test (PCT) on a key pair is performed it is known whether the keys will be used in a key agreement scheme, digital signature algorithm or to perform a key transport, then the PCT shall be performed consistent with the intended use of the keys (i.e., ISO/IEC 24759 TE10.35.01 for key transport, TE10.35.021 for signatures, or TE10.35.032 for key agreement), even if the underlying standard does not require a PCT. If at the time when the PCT is performed the keys’ intended usage is not known, then any of the three PCTs described in AS10.35 shall be performed on this key pair.

FIPS 205

A CAST corresponding to each function/mode (signature generation/signature verification/key generation) supported by the module shall be implemented as follows:

• SLH-DSA Signature generation CAST
• SLH-DSA Signature verification CAST
• SLH-DSA Key Generation CAST
• CASTs shall be performed on at least two of the following parameter-sets if both types are supported: one that uses SHA2 and one that uses SHAKE.

If both SLH-DSA signature generation and pre-hash SLH-DSA signature generation (Section 10.2.2 and Algorithm 23 in FIPS 205) are implemented and they both share the same underlying cryptographic implementations, a CAST on either one of them is sufficient to meet the CAST requirements for both. Likewise, for SLH-DSA signature verification and pre-hash SLH-DSA signature verification, a CAST on either of them is sufficient.

Finally, for key pairs generated for use with approved algorithms in FIPS 205, the pair-wise consistency test (PCT) (described in the ISO/IEC 24759 TE10.35.02) may be limited to confirming the same key identifier (PK.SEED for SLH-DSA) is shared by the resulting public and private key following generation.