Post-quantum algorithm comparison

Post-quantum algorithm comparison collects the key figures for the NIST post-quantum standards and the classical algorithms they replace: key, ciphertext, and signature sizes, speed character, security basis, and standardization status. Sizes are exact bytes from the final FIPS documents and original specifications. For how these algorithms were chosen, see NIST Post-Quantum Cryptography Standardization; individual entries: ML-KEM, ML-DSA, SLH-DSA, FN-DSA / Falcon, HQC.

#NIST security categories

NIST defines five security categories by comparison to attacks on symmetric primitives rather than abstract bit counts: a scheme meets a category if every known attack, classical or quantum, costs at least as much as the reference attack. Quantum search speedups against symmetric primitives are limited and well understood (Grover's algorithm), which makes these benchmarks stable anchors, unlike RSA and elliptic curves, which Shor's algorithm breaks outright.

Category 3 is the common deployment default (ML-KEM-768, ML-DSA-65); category 5 appears where policy demands maximum margin.

#Key establishment

The table compares KEMs with the elliptic-curve Diffie-Hellman key exchange they replace. For ECDH, the "ciphertext" column is the public share sent per direction. ML-KEM shared secrets are 32 bytes, HQC's are 64.

ML-KEM's arithmetic is fast enough that a full encapsulation plus decapsulation typically beats an X25519 exchange on modern CPUs; the real cost of the migration is the roughly 35-fold growth in bytes on the wire, about 2.3 KB per handshake for the deployed hybrid versus 64 bytes for pure X25519. See post-quantum TLS and hybrid cryptography.

#Digital signatures

The table compares the NIST post-quantum digital signature scheme schemes with Ed25519, ECDSA, and RSA. Speed entries describe desktop-class CPUs; exact throughput varies by implementation.

RSA-2048 sizes are the raw 2048-bit modulus and signature; encoded public keys are slightly larger. Falcon signatures are variable length, listed in the fixed padded format of the specification.

#What the numbers mean in practice

• Handshakes: swapping X25519 for the deployed hybrid grows each TLS handshake by about 2.3 KB, which measured deployments have shown is acceptable on the public Internet.
• Certificates: a certificate carries a public key and a signature. With ECDSA P-256 that is under 100 bytes of cryptographic material; with ML-DSA-65 it is about 5.3 KB, and a typical chain of three certificates multiplies the growth. This, not raw speed, is the hard problem in PKI migration to post-quantum.
• Choosing a signature: ML-DSA is the general-purpose default. SLH-DSA buys the most conservative assumptions with large, slow signatures, fitting firmware, code signing, and trust anchors. FN-DSA wins where bytes are scarce and verification dominates, once FIPS 206 is finished.
• Choosing a KEM: ML-KEM-768 is the default; HQC exists as a standardized fallback on non-lattice mathematics.
• Symmetric cryptography survives: AES-256 and SHA-2/SHA-3 need no replacement, only conservative parameter choices, since quantum attacks on them are limited to Grover-type speedups.

Migration playbooks favor hybrids and cryptographic agility: combine a classical and a post-quantum algorithm during the transition, and build systems that can swap algorithms without redesign, since FIPS 206 and the HQC standard will keep the target moving through the late 2020s.