pqcstatus
Algorithm

ML-KEM: quantum risk, deadlines and replacements

Quantum-resistant

NIST's standard post-quantum key encapsulation mechanism (FIPS 203), derived from CRYSTALS-Kyber.

At a glance

Quantum riskQuantum-resistant
Used forKey establishment
Post-quantum algorithmYes

Variants and security strength

VariantClassical security (bits)
ML-KEM-512128
ML-KEM-768192
ML-KEM-1024256

Positions and deadlines by authority

AuthorityPositionEffectiveScopeDetails
NISTRecommendedin forceall variants
ANSSIRecommendedin forceML-KEM-1024ANSSI prefers the highest security level (5), in hybrid mode.
ANSSIAcceptablein forceML-KEM-768Level 3 accepted by ANSSI, in hybrid mode.
BSIRecommendedin forceML-KEM-768, ML-KEM-1024BSI recommends ML-KEM-768/1024 in hybrid combination with a classical scheme; ML-KEM-512 is not recommended.
NSA (CNSA 2.0)Recommendedin forceML-KEM-1024CNSA 2.0 requires ML-KEM-1024.

Sources

  1. FIPS 203 — Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM) · NIST
  2. ANSSI views on the Post-Quantum Cryptography transition (2023 follow-up) · ANSSI (guidance)
  3. FAQ — Cryptographie post-quantique · ANSSI (guidance)
  4. BSI TR-02102-1 — Cryptographic Mechanisms: Recommendations and Key Lengths (Version 2026-01) · BSI
  5. CNSA 2.0 Algorithms (Cybersecurity Advisory) · NSA (guidance)

Catalog version 2026-09-28. Every position links to its primary source; draft documents are labelled as such.

Frequently Asked Questions

Is ML-KEM quantum-safe?

Yes. No known quantum attack breaks ML-KEM at the recommended parameter sizes.