Inside the NIST PQC suite: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205)

1
parameter      sec. cat   pub key   ciphertext   shared secret
2
─────────────────────────────────────────────────────────────
3
ML-KEM-512     NIST L1    800 B     768 B        32 B
4
ML-KEM-768     NIST L3    1184 B    1088 B       32 B
5
ML-KEM-1024    NIST L5    1568 B    1568 B       32 B

1
# pip install pqcrypto
2
from pqcrypto.kem import ml_kem_768
3
 
4
# Recipient generates a keypair, publishes pub.
5
pub, priv = ml_kem_768.generate_keypair()
6
# Sender encapsulates against pub.
7
ciphertext, ss_sender = ml_kem_768.encrypt(pub)
8
# Recipient decapsulates the ciphertext.
9
ss_recipient = ml_kem_768.decrypt(priv, ciphertext)
10
assert ss_sender == ss_recipient    # 32 bytes of shared secret

1
import { ml_kem768 } from '@noble/post-quantum/ml-kem';
2
 
3
const kp = ml_kem768.keygen();                                    // {publicKey, secretKey}
4
const { cipherText, sharedSecret: sndSS } = ml_kem768.encapsulate(kp.publicKey);
5
const rcvSS = ml_kem768.decapsulate(cipherText, kp.secretKey);
6
// sndSS === rcvSS (32 bytes)

1
parameter      sec. cat   pub key   priv key   signature
2
──────────────────────────────────────────────────────────
3
ML-DSA-44      NIST L2    1312 B    2560 B     2420 B
4
ML-DSA-65      NIST L3    1952 B    4032 B     3293 B
5
ML-DSA-87      NIST L5    2592 B    4896 B     4595 B

1
from pqcrypto.sign import ml_dsa_65
2
 
3
pub, priv = ml_dsa_65.generate_keypair()
4
msg  = b"the message to sign"
5
sig  = ml_dsa_65.sign(priv, msg)            # 3293 bytes
6
ok   = ml_dsa_65.verify(pub, msg, sig)      # raises on fail

1
import { ml_dsa65 } from '@noble/post-quantum/ml-dsa';
2
 
3
const kp = ml_dsa65.keygen();
4
const msg = new TextEncoder().encode('the message to sign');
5
const sig = ml_dsa65.sign(msg, kp.secretKey);
6
const ok  = ml_dsa65.verify(sig, msg, kp.publicKey);    // boolean

1
parameter         sec. cat   pub key   signature   verify
2
──────────────────────────────────────────────────────────
3
SLH-DSA-128s      L1         32 B      7856 B      fast
4
SLH-DSA-128f      L1         32 B      17088 B     fast
5
SLH-DSA-192s      L3         48 B      16224 B     fast
6
SLH-DSA-192f      L3         48 B      35664 B     fast
7
SLH-DSA-256s      L5         64 B      29792 B     fast
8
SLH-DSA-256f      L5         64 B      49856 B     fast

1
from pqcrypto.sign import sphincs_sha2_128s_simple as slh
2
 
3
pub, priv = slh.generate_keypair()
4
msg  = b"firmware image hash"
5
sig  = slh.sign(priv, msg)
6
ok   = slh.verify(pub, msg, sig)

1
Need to encapsulate a key (TLS, JWE, MLS, KMS envelope)?
2
   └─ ML-KEM-768
3
 
4
Need to sign a per-message token (JWT, OCSP, request signing)?
5
   ├─ Long-lived service?   → ML-DSA-65 hybrid with Ed25519
6
   └─ Per-request perf?     → ML-DSA-65 alone (already fast)
7
 
8
Need to sign a release artifact (one-shot, verified for years)?
9
   └─ SLH-DSA-128s   (the "100-year vault" pick)
10
 
11
Bandwidth-constrained signing?
12
   └─ Wait for FIPS 206 (Falcon)
13
 
14
Pure-PHP verification on shared hosting?
15
   └─ SLH-DSA-128s — verification is hash-only

1
# Hybrid TLS shared secret = HKDF(X25519_ss || ML_KEM_ss, salt, info)
2
import os
3
from cryptography.hazmat.primitives import hashes
4
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
5
from pqcrypto.kem import ml_kem_768
6
 
7
# Run both KEMs side by side.
8
pq_pub, pq_priv = ml_kem_768.generate_keypair()
9
pq_ct, pq_ss    = ml_kem_768.encrypt(pq_pub)
10
x_ss            = os.urandom(32)   # in reality: X25519 shared secret
11
 
12
shared = HKDF(
13
    algorithm=hashes.SHA384(), length=32,
14
    salt=b'qbit404-hybrid', info=b'tls-1.3-key-derivation'
15
).derive(x_ss + pq_ss)

1
[ ] CBOM (cryptography BOM) — enumerate every key.
2
[ ] Edge TLS:        hybrid KEM advertised.
3
[ ] Code signing:    SLH-DSA root rotation planned.
4
[ ] JWT issuers:     ML-DSA hybrid emitting.
5
[ ] SDK pinning:     ML-KEM / ML-DSA aliases, NOT Kyber / Dilithium aliases.
6
[ ] CAVP validation: required for FedRAMP / national security workloads.