Primary sources: PQC standards and authoritative guidance
The authoritative documents this knowledge base is built on (the finalized NIST standards, the government migration roadmaps, and the identity and authentication standards), each with a one-line description of what it is.
Go to the source
Everything in this knowledge base traces back to a small set of authoritative documents. When a claim matters, read the primary source. This page collects the ones worth bookmarking (the NIST post-quantum standards, the US and CISA migration guidance, and the identity and authentication standards) with a one-line note on what each is for.
NIST post-quantum cryptography standards
In 2024 NIST finalized the first post-quantum standards. These are the algorithms to migrate to, and the reference point for any vendor's PQC claims. See NIST's Post-Quantum Cryptography project for the program that produced them.
- FIPS 203 (ML-KEM): the standardized post-quantum key-encapsulation mechanism (derived from CRYSTALS-Kyber). This is what replaces vulnerable key exchange; the priority for harvest-now-decrypt-later.
- FIPS 204 (ML-DSA): the primary post-quantum digital-signature standard (derived from CRYSTALS-Dilithium), for certificates, code signing, and document signing.
- FIPS 205 (SLH-DSA): a stateless hash-based signature standard (derived from SPHINCS+), a conservative signature alternative resting on hash-function security.
- NIST CSRC: Post-Quantum Cryptography: the hub for the standardization effort, drafts, and ongoing algorithm selection.
Migration roadmaps and government guidance
- CISA: Post-Quantum Cryptography Initiative: the US cybersecurity agency's hub for PQC readiness, roadmap, and resources.
- CISA/NSA/NIST - Quantum-Readiness: Migration to Post-Quantum Cryptography: the joint factsheet on building a cryptographic inventory and preparing to migrate.
- NIST IR 8547: Transition to Post-Quantum Cryptographic Standards: NIST's guidance on deprecating quantum-vulnerable algorithms over time.
- NIST NCCoE: Migration to Post-Quantum Cryptography: practical, vendor-neutral guidance on crypto-agility and migration.
Identity, passwords, and authentication
- NIST SP 800-63B: Digital Identity Guidelines (Authentication): the modern standard for passwords and authenticators: length over forced complexity, no periodic rotation without cause, phishing-resistant authentication.
- FIDO Alliance: Passkeys: the industry body behind FIDO2/WebAuthn and the passkey user experience.
- W3C: Web Authentication (WebAuthn): the browser API standard underpinning passkeys and hardware security keys.
- CISA: Secure Our World: plain-language public guidance on MFA, passwords, phishing, and updates.
Beware second-hand summaries
PQC is a fast-moving field surrounded by marketing. When a vendor or article makes a specific claim ('quantum-safe', 'NIST-approved', a particular deadline), check it against the primary source above. The standards say precisely what they cover, and a surprising number of confident claims do not survive that check.