People whose information sits in an employer’s or service provider’s systems did not receive an automatic security upgrade on August 13, 2024. That day, the US National Institute of Standards and Technology released three finalized post-quantum cryptography standards. Its announcement encouraged administrators to begin integration and explicitly said that completing the work would take time. [nist]

One of those standards, FIPS 203, specifies ML-KEM: a mechanism for establishing a shared secret key over a public channel. That key can then support encryption through symmetric-key algorithms. ML-KEM is not itself a tool that directly encrypts an entire personnel file or email archive. Publishing its specification does not establish that any particular service uses it. [fips203]

The standard also makes responsibility explicit. Conformance does not ensure that an implementation is secure, and a conforming product does not guarantee the security of the system around it. Implementers remain responsible for secure design. For workers and customers, our reading is that the relevant distinction is between an available protective component and a service that has actually integrated it safely. [fips203]

Our public-interest judgment is to ask who will do that integration work and how its completion will be demonstrated, rather than treating the announcement as a finished benefit. Common specifications give implementers something concrete to work from; these documents do not quantify staffing, costs or deployment progress. Both are NIST publications, not independent corroboration. This retrospective concerns the August 13 release, not subsequent revisions. [nist][fips203]

Source documents

  1. NIST Releases First 3 Finalized Post-Quantum Encryption Standards | NISThttps://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
  2. Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf