Primary sources: PQC standards and authoritative guidance
The authoritative documents this knowledge base is built on — the finalized NIST standards, the government migration roadmaps, and the identity and authentication standards — each with a one-line description of what it is.
Go to the source
Everything in this knowledge base traces back to a small set of authoritative documents. When a claim matters, read the primary source. This page collects the ones worth bookmarking — the NIST post-quantum standards, the US and CISA migration guidance, and the identity and authentication standards — with a one-line note on what each is for.
NIST post-quantum cryptography standards
In 2024 NIST finalized the first post-quantum standards. These are the algorithms to migrate to, and the reference point for any vendor's PQC claims. See NIST's Post-Quantum Cryptography project for the program that produced them.
- FIPS 203 (ML-KEM) — the standardized post-quantum key-encapsulation mechanism (derived from CRYSTALS-Kyber). This is what replaces vulnerable key exchange; the priority for harvest-now-decrypt-later.
- FIPS 204 (ML-DSA) — the primary post-quantum digital-signature standard (derived from CRYSTALS-Dilithium), for certificates, code signing, and document signing.
- FIPS 205 (SLH-DSA) — a stateless hash-based signature standard (derived from SPHINCS+), a conservative signature alternative resting on hash-function security.
- NIST CSRC — Post-Quantum Cryptography — the hub for the standardization effort, drafts, and ongoing algorithm selection.
Migration roadmaps and government guidance
- CISA — Post-Quantum Cryptography Initiative — the US cybersecurity agency's hub for PQC readiness, roadmap, and resources.
- CISA/NSA/NIST — Quantum-Readiness: Migration to Post-Quantum Cryptography — the joint factsheet on building a cryptographic inventory and preparing to migrate.
- NIST IR 8547 — Transition to Post-Quantum Cryptographic Standards — NIST's guidance on deprecating quantum-vulnerable algorithms over time.
- NIST NCCoE — Migration to Post-Quantum Cryptography — practical, vendor-neutral guidance on crypto-agility and migration.
Identity, passwords, and authentication
- NIST SP 800-63B — Digital Identity Guidelines (Authentication) — the modern standard for passwords and authenticators: length over forced complexity, no periodic rotation without cause, phishing-resistant authentication.
- FIDO Alliance — Passkeys — the industry body behind FIDO2/WebAuthn and the passkey user experience.
- W3C — Web Authentication (WebAuthn) — the browser API standard underpinning passkeys and hardware security keys.
- CISA — Secure Our World — plain-language public guidance on MFA, passwords, phishing, and updates.
Beware second-hand summaries
PQC is a fast-moving field surrounded by marketing. When a vendor or article makes a specific claim — 'quantum-safe', 'NIST-approved', a particular deadline — check it against the primary source above. The standards say precisely what they cover, and a surprising number of confident claims do not survive that check.