# NIST post-quantum standards

> What the 2024 NIST post-quantum standards are, and where QRL's signature schemes fit in.

QRL didn't invent its cryptography in a vacuum. The post-quantum signatures it uses are part of a global standardisation effort led by **NIST** (the US National Institute of Standards and Technology). Knowing the landscape helps put QRL's choices in context.

## Why a standardisation effort was needed

For decades, the cryptography securing the internet (RSA, elliptic curves) was a known quantity. The looming [quantum threat](/learn/how-quantum-computers-break-crypto) changed that: the world needed replacement algorithms believed safe against quantum computers, vetted in the open rather than chosen by any single vendor.

So in 2016 NIST launched a **public competition**. Cryptographers worldwide submitted candidate algorithms, attacked each other's designs for years, and the strongest survivors were standardised. The first finalised standards landed in **2024**.

## The 2024 standards

The headline finalised standards are:

- **FIPS 203 — ML-KEM** (from CRYSTALS-Kyber): for *key encapsulation* / key exchange.
- **FIPS 204 — ML-DSA** (from CRYSTALS-Dilithium): for *digital signatures*.
- **FIPS 205 — SLH-DSA** (from SPHINCS+): a *hash-based* signature, as a conservative alternative.

For a blockchain, the relevant one is **signatures** — FIPS 204, ML-DSA.

## Where QRL fits

QRL uses two post-quantum signatures, one on each chain, and both line up with recognised standards:

- **QRL 2.0 → [ML-DSA-87](/learn/ml-dsa-87-explained)**, the highest (level-5) parameter set of **ML-DSA / FIPS 204**. This is the modern, NIST-standardised lattice signature.
- **QRL Legacy → [XMSS](/learn/xmss-explained)**, a **hash-based** signature standardised earlier as **RFC 8391** and reflected in NIST's guidance on stateful hash-based signatures (SP 800-208).

In other words, QRL Legacy was an *early* adopter of a hash-based standard, and QRL 2.0 adopts the *newest* lattice-based one. Both sit firmly within the standardised post-quantum toolbox rather than relying on home-grown schemes.

## What standardisation does and doesn't promise

Standardisation means an algorithm survived years of expert scrutiny and is recommended for real-world use. It does **not** mean it is proven unbreakable — no practical scheme is. As with all [post-quantum cryptography](/learn/glossary#post-quantum), the claim is "no known efficient attack," backed by intense public analysis. That's the strongest assurance modern cryptography offers.

## Where to go next

- [ML-DSA-87 explained](/learn/ml-dsa-87-explained) — QRL 2.0's FIPS 204 signature.
- [Hash-based signatures](/learn/hash-based-signatures) — the family behind XMSS and SLH-DSA.
- [Grover's algorithm and hash functions](/learn/grover-and-hash-functions) — why hashing stays strong.