Marin Ivezic
ML-KEM-768 is the parameter set most of the public internet has settled on. Chrome negotiates it by default, Cloudflare terminates it at the edge, and the IETF hybrid group X25519MLKEM768 wraps it around a classical elliptic-curve exchange. NIST treats it as adequate for general use. It is also not approved for United States national security systems, which require ML-KEM-1024. And on its own it will not satisfy a French product seeking a security visa from ANSSI, the French cybersecurity agency, because ANSSI requires post-quantum key establishment to run alongside a classical exchange rather than replace it. One algorithm, three jurisdictions, three different requirements.
None of those differences shows up in an inventory that records algorithm names, which is where most migration programmes start and where a good number of them stop.
A key encapsulation mechanism, or KEM, is the component two parties use to agree on a shared secret across an open channel. NIST standardised one in August 2024 as FIPS 203 and named it ML-KEM; it was submitted to the competition as CRYSTALS-Kyber and is still widely called that. The signature standards were renamed the same way. ML-DSA is FIPS 204, formerly CRYSTALS-Dilithium. SLH-DSA is FIPS 205, formerly SPHINCS+. FN-DSA, formerly FALCON, remains in draft as FIPS 206. In 2025 NIST announced that it would standardise HQC, a code-based KEM, as a second key-establishment algorithm to sit beside ML-KEM.
Those five algorithms are the baseline most of the world will build on. They are not the whole requirement anywhere, and the ways national requirements depart from them fall into four groups. We call them axes because a system can sit at a different point on each one independently, and because they get progressively harder to accommodate.
The first axis is the approved algorithm set, meaning which primitives a jurisdiction will accept at all. The second is parameters and internal primitives, the security level and the building blocks mandated inside an approved algorithm. The third is composition, whether post-quantum key establishment stands alone or has to be combined with something else. The fourth is validation and custody, where the implementation has to be certified and where the key material has to sit.
Crypto-agility, as the market usually sells it, means the ability to swap one algorithm for another without re-architecting the system. That covers the first axis and part of the second. The remaining two change protocol design and deployment topology, and no algorithm abstraction layer removes them.
The Classical Split Is the Precedent
Cryptographic divergence along national lines isn’t new, and the classical era is a reasonable guide to how this goes.
Trust in United States cryptographic standards took lasting damage in 2013, when documents published that year indicated that the Dual_EC_DRBG random number generator, then a NIST recommendation, had a structure permitting a backdoor for anyone who knew the relationship between two of its constants. NIST withdrew the algorithm in 2014. The technical damage was contained. The reputational damage was not, and it is still cited by standards bodies outside the United States as a reason to keep their own evaluation capability.
China had already gone its own way. The SM series – SM2 for elliptic-curve signature and encryption, SM3 for hashing, SM4 for block encryption – was published as Chinese national commercial cryptography and then given legal force. The Cryptography Law of the People’s Republic of China has been in effect since January 2020, and systems in scope, critical information infrastructure in particular, undergo a commercial cryptography application security assessment, a formal review in which the use of approved domestic algorithms is a condition of passing. Russia kept the GOST family through the AES era for the same reasons, and Russian state information systems continue to require cryptographic modules certified by the FSB.
Global technology firms coped with all of this by shipping more than one stack, gating features by region, and translating at gateways. It worked, expensively, and it took two decades.
Two things are different this time. The divergence has dates attached, because regulators rather than product cycles are setting the pace. The UK’s National Cyber Security Centre (NCSC) set out a migration timeline in its March 2025 guidance, Timelines for migration to post-quantum cryptography, requiring organisations to define migration goals and complete discovery by 2028, finish the highest-priority migrations by 2031, and complete the transition by 2035. The EU’s NIS Cooperation Group adopted its coordinated implementation roadmap for the transition to post-quantum cryptography in June 2025. The NSA’s CNSA 2.0 suite requires full transition of national security systems by 2033.
The second difference is that the divergence is happening on four levels at once rather than at the algorithm level alone. That is why a programme built around swapping one primitive for another will only get part of the way.
Axis 1. Which Algorithms Are Approved
Where Allied Agencies Already Differ
The transatlantic picture is often described as alignment, and at the level of ML-KEM and ML-DSA it is. Below that level, the recommended sets already differ.
Germany’s BSI, the federal information security office, has for several years recommended FrodoKEM and Classic McEliece in its TR-02102 technical guideline for key establishment, alongside its endorsement of the NIST standards. The reasoning is conservatism. FrodoKEM is built on plain learning-with-errors rather than the structured module lattices ML-KEM uses, which removes an algebraic structure that some cryptographers regard as an unnecessary assumption. Classic McEliece is code-based and has survived analysis since 1978. The Dutch PQC Migration Handbook, published by AIVD, TNO and CWI, lists the same alternatives for long-lived secrets.
Neither agency is arguing that ML-KEM is unsound. Both are hedging against a single mathematical family carrying the whole burden, and an architect building for a German or Dutch high-assurance customer may find those recommendations turning into requirements.
Where National Sets Are Being Built
South Korea ran a national competition, KpqC, from 2021, and concluded it with four selections. HAETAE and AIMer cover signatures; SMAUG-T and NTRU+ cover key establishment. Three are lattice designs, two of them close cousins of the NIST picks. AIMer is not, being built on a multiparty-computation-in-the-head construction that depends on symmetric primitives rather than lattice hardness. Korea’s selection is a diversification strategy under domestic control, not a rejection of ML-KEM.
China’s Institute of Commercial Cryptography Standards issued a global call in early 2025 for quantum-resistant public-key algorithms, signatures, hash functions and block ciphers, aimed at producing Chinese national standards. Given the SM precedent, the working assumption for anyone shipping into China should be that the results become mandatory for systems in regulatory scope, on a timetable set in Beijing.
Russia has had a post-quantum working group under technical committee TC26 since 2019 and a national centre coordinating candidate evaluation since 2022. Candidates discussed in the open literature include a signature scheme called Shipovnik, and code-based key encapsulation is also under evaluation. No national standard has been published yet.
What Supporting a Second Algorithm Costs
Adding an algorithm is not a configuration change. It is library code, test vectors, a certification path, and often a protocol change, because post-quantum objects are not interchangeable in size.
ML-KEM-768 has an encapsulation key of 1,184 bytes and a ciphertext of 1,088 bytes, which most protocols absorb without redesign. FrodoKEM-976 has a public key of roughly 15 KB. Classic McEliece has a public key of 261 KB at its smallest parameter set and over a megabyte at its largest, with ciphertexts of a couple of hundred bytes. Those are not alternatives you can drop into the same handshake and the same certificate profile. They are a different protocol design, suited to long-lived static keys rather than per-connection exchange, and teams that treat them as swap-in options discover this late.
Axis 2. Which Parameters and Primitives Are Mandated
NIST rates post-quantum algorithms against five security categories, where each category is defined by the effort needed to break the scheme relative to a symmetric benchmark. Category 1 is roughly AES-128, category 3 roughly AES-192, category 5 roughly AES-256. ML-KEM-512, 768 and 1024 sit at categories 1, 3 and 5. ML-DSA-44, 65 and 87 sit at categories 2, 3 and 5.
The general internet has converged on category 3. Two national requirements have not.
The NSA’s CNSA 2.0 suite specifies ML-KEM-1024 and ML-DSA-87 and nothing lower, with the transition of national security systems complete by 2033. Australia’s Signals Directorate takes the same position on parameters and a harder one on timing, with its Information Security Manual set to stop approving RSA, Diffie-Hellman, ECDH and ECDSA from 2030, five years ahead of the date most other agencies use.
The size consequences are modest per operation and material at scale. ML-KEM-1024 carries a 1,568-byte encapsulation key and a 1,568-byte ciphertext against 1,184 and 1,088 at the 768 level. An ML-DSA-87 signature is 4,595 bytes against 3,293 for ML-DSA-65. In a certificate chain with three signatures, in a firmware image with a fixed signature slot, or on a smart card with fixed EEPROM, that difference decides whether the design works.
The second half of this axis is quieter and harder. Post-quantum schemes are built out of hash functions and symmetric primitives, and jurisdictions with national primitives have a long history of substituting them. Russia standardised Streebog as its hash and used it inside its signature and padding schemes rather than adopting SHA-2. China does the same with SM3. Japan’s CRYPTREC list keeps Camellia alongside AES, which shows the preference for domestic primitives is not confined to jurisdictions that distrust Washington. SLH-DSA already ships in SHA-2 and SHAKE variants, so the mechanism for national variants exists inside the standard itself.
A substituted internal hash produces an algorithm with the same name and a different implementation, different test vectors, no interoperability with the standard version, and a separate validation. Two systems can both report ML-DSA in their inventories and be unable to verify each other’s signatures.
Axis 3. How Algorithms Must Be Composed
Hybrid key establishment runs two independent key exchanges, typically one classical and one post-quantum, and combines the two shared secrets so that an attacker has to break both to recover the session key. It costs bandwidth and code, and it protects against the possibility that a young post-quantum design turns out to be weak.
The Position Split
Whether hybrid is required, permitted or discouraged now depends on who is certifying the product.
ANSSI requires it. Its phased plan makes hybridisation mandatory for products needing long-term protection, and its follow-up position paper on post-quantum cryptography states that it will not grant a security visa to a mechanism relying on post-quantum cryptography alone before 2030. Germany’s BSI recommends hybrid key establishment. The Dutch handbook recommends it.
The NSA has taken the opposite view, saying it does not expect to approve hybrid solutions for national security systems beyond what standards compliance and interoperability require, on the grounds that the added complexity is itself an attack surface. The UK’s NCSC sits in between, treating hybrid as a transitional measure rather than an end state.
So a product that must hold both a French security visa and a CNSA 2.0 posture cannot ship one cryptographic configuration. This is the point on the four axes where the divergence stops being a parameter table and becomes a protocol decision, because hybrid changes the handshake, the key schedule, the negotiation logic and the failure modes.
Composite Certificates
The signature equivalent is a composite certificate, a single certificate that carries two public keys and two signatures, so that a verifier checks both and the certificate satisfies two regimes at once. The IETF’s LAMPS working group has drafts defining composite ML-DSA constructions. The mechanism is the most plausible route to a single artefact that passes review in multiple jurisdictions, and it’s still in draft, which means anyone designing a certificate profile today is designing against a moving target.
The practical instruction is to leave room. A composite certificate carrying an ML-DSA-87 signature and a classical one runs to roughly five kilobytes of signature material before anything else in the certificate is counted, and chain-length assumptions written for 256-byte RSA signatures will not survive.
Axis 4. Where Validation and Keys Must Sit
The fourth axis has no algorithmic content at all, which is why algorithm-centric migration plans miss it entirely.
A United States federal system does not need a correct ML-KEM implementation. It needs a FIPS 140-3 validated cryptographic module, and the validation certificate names a specific module version in a specific operating environment. Correct code that has not been through the Cryptographic Module Validation Program does not qualify. In the European Union, the EUCC scheme under the Cybersecurity Act, adopted in January 2024 and applicable from February 2025, provides the equivalent route on Common Criteria foundations. In China, the commercial cryptography assessment described earlier applies to systems in scope. In Russia, state systems require FSB-certified cryptographic modules.
Custody is the other half. Where keys are generated, which hardware security module holds them, which jurisdiction’s courts can compel access to that hardware, and whether a cloud provider’s key management service satisfies a national requirement are all questions the algorithm choice does not answer. Sovereign cloud offerings and hold-your-own-key architectures exist because of this axis, not because of anything in FIPS 203.
Supporting two validation regimes means two evaluated builds, sometimes two hardware variants, always two certification programmes with separate budgets, separate evidence packages and separate lead times measured in months. A change on axis 2, such as substituting an internal hash, can invalidate a certificate obtained on axis 4 and restart the clock.
There is no abstraction layer for this. It shows up in the bill of materials, the release process and occasionally the corporate structure.
Designing for Four Axes Instead of One
The narrow definition of crypto-agility, algorithm replacement without re-architecture, covers axis 1 and most of axis 2, which is real progress and roughly half the problem. We think the working definition needs to be wider, because the two axes it leaves out are the two that cost the most to retrofit.
Four things change if the wider definition is adopted.
The inventory records more than algorithm names. For every use of cryptography, four additional fields: the parameter set, the composition and what it is combined with, the module performing the operation and its validation status, and the physical and legal location of the key material. Most cryptographic bills of materials today capture algorithm and library version, which is enough to answer the question “are we using RSA anywhere” and not enough to answer “can this service be deployed in France.”
Policy becomes a resolvable object rather than a global default. One policy per jurisdiction, naming the permitted algorithm set, the minimum parameter set, the composition rule and the required validation, resolved at deployment time and again at connection time. The handshake logic has to be able to reject a peer that offers an approved algorithm at an unapproved parameter set, which most negotiation code cannot currently express.
Size budgets get set before they are committed. Certificate profiles, MTU assumptions, firmware signature slots, secure element memory. The numbers to design against are the largest ones a target market might require, not the ones in the default configuration. Retrofitting a size assumption into deployed hardware isn’t possible.
Certification lead time sits on the critical path. If a design decision on axis 2 or axis 3 invalidates an evaluation, the schedule impact is the evaluation, not the code change.
There is a fifth decision, and it’s the cheapest one available. Decide early which axes are out of scope. A product that will never enter the Chinese or Russian markets doesn’t need to carry those requirements, and writing that down is far less expensive than discovering the assumption halfway through a certification cycle.
| Axis | What varies | What it costs to support |
|---|---|---|
| 1. Algorithm set | Which primitives are approved at all | Library code, test vectors, protocol redesign where object sizes differ by orders of magnitude |
| 2. Parameters and primitives | Security category, internal hash and symmetric building blocks | Bandwidth and storage, separate test vectors, a separate validation for substituted primitives |
| 3. Composition | Hybrid mandatory, permitted, or discouraged | Handshake and key-schedule changes, certificate profile changes, per-peer policy logic |
| 4. Validation and custody | Which scheme certifies the module, where keys reside | Separate evaluated builds, sometimes separate hardware, certification cycles measured in months |
The transition to post-quantum cryptography is being described in most boardrooms as an algorithm replacement programme with a 2035 deadline. For an architecture that has to work in one jurisdiction, that description holds. For an architecture that has to work in several, the algorithm is the part that was already decided, and the other three axes are the design work.
Quantum Academy’s post-quantum training covers cryptographic inventory scope, hybrid and composite design, and the certification questions that determine deployment topology, with the four axes above treated as design decisions rather than as a compliance checklist. Programme details are at quantumacademy.com/.
For migration methodology, the PQC Migration Framework sets out the phase structure this article assumes. For the country-by-country picture in more depth, including the national standardisation efforts summarised here, see the longer treatment of sovereignty and post-quantum cryptography on PostQuantum.com.