Kyber Is Now ML-KEM: The Post-Quantum Names, Decoded

If you have gone looking for post-quantum cryptography (PQC) recently, you have probably hit the same wall everyone else does. The algorithms have two sets of names, half the internet uses one set and the standards use the other, and nothing tells you they are the same thing.

So, the short version first.

• Kyber is now ML-KEM, standardised as FIPS 203
• Dilithium is now ML-DSA, standardised as FIPS 204
• SPHINCS+ is now SLH-DSA, standardised as FIPS 205
• Falcon is becoming FN-DSA, FIPS 206, still in development as of September 2026

Same algorithms. Different names. Nothing was replaced, nothing was withdrawn, and if a course or a video is still saying "Kyber", it is not out of date about the technology, only about the label.

That is the answer. The rest of this is what post-quantum cryptography actually is, why the names changed, and why an entire industry is replacing cryptography that nobody has broken.

Table of Contents

• What is post-quantum cryptography?
• Why the names changed at all
• How algorithms usually die
• Why this time is different
• What quantum computing actually breaks
• No, there is no machine that can do this
• The reason it still matters today
• Is PQC on cybersecurity exams?
• Conclusion

What is post-quantum cryptography?

Post-quantum cryptography is ordinary cryptography, running on ordinary computers, designed so that a quantum computer cannot break it.

That sentence contains the most common misunderstanding in the field, so it is worth being blunt about it. Post-quantum cryptography does not run on a quantum computer. There is no quantum hardware involved anywhere. ML-KEM runs on your laptop, your phone and your web server, on the same processors as everything else. If you can run AES today, you can run ML-KEM today.

It gets confused with quantum cryptography, which usually means quantum key distribution, and that is a genuinely different thing. QKD uses the physics of photons to distribute keys, needs specialised hardware and its own fibre, and solves a much narrower problem. A rough test: if someone is selling you a box, it is not post-quantum cryptography. PQC is a software change.

What actually changes is the hard problem underneath. Public-key cryptography works by resting on something easy to state and infeasible to compute: factoring a large number, in the case of RSA, or the discrete logarithm, for Diffie-Hellman and elliptic curves. Shor's algorithm solves both efficiently, so both foundations give way at the same moment. The replacements are built on problems that no known quantum algorithm handles well:

• Structured lattices, for ML-KEM and ML-DSA
• Hash functions, for SLH-DSA
• Error-correcting codes, for HQC

That variety is deliberate. Lattices are fast and compact and general-purpose, which is why they carry the main standards. But everything resting on lattices would fall together if a weakness in lattice problems were ever found. SLH-DSA rests on hash functions instead, which are about as well understood as anything in cryptography. It is slower and its signatures are far larger, and it was standardised anyway precisely because it fails independently of the others. It is the insurance policy rather than the daily driver.

Why the names changed at all

The old names were submission names. NIST ran a public competition from 2016 to select quantum-resistant algorithms, and teams entered under names they picked themselves. CRYSTALS-Kyber and CRYSTALS-Dilithium came from the same research group, hence the shared prefix. SPHINCS+ and Falcon came from others.

When an algorithm stops being a competition entry and becomes a federal standard, it gets a name that describes what it does rather than what its authors called it:

• ML-KEM is Module-Lattice-Based Key-Encapsulation Mechanism
• ML-DSA is Module-Lattice-Based Digital Signature Algorithm
• SLH-DSA is Stateless Hash-Based Digital Signature Algorithm

Dull, but informative. "ML" tells you the security rests on lattice problems. "SLH" tells you it rests on hash functions instead, which is the deliberate diversity described above. "KEM" tells you the thing establishes a shared secret rather than encrypting your data directly, which is a distinction that catches people out.

How algorithms usually die

To understand why this transition feels strange, it helps to look at how the previous ones went.

DES became a federal standard in 1977 with a 56-bit key that was controversial for being too short even then. It survived twenty years of that argument. In 1998 the Electronic Frontier Foundation built a machine for around a quarter of a million dollars and broke a DES key in 56 hours, which ended the debate rather more decisively than the papers had. It was formally withdrawn years later, by which point everyone serious had already gone.

MD5 shipped in 1992 and was everywhere within a decade: certificates, package checksums, password storage. Practical collisions arrived in 2004. Researchers used them to forge a certificate authority signature in 2008. And yet MD5 turns up in production systems to this day, more than twenty years after it was broken.

SHA-1 followed the same script. Standardised 1995, theoretical weaknesses in 2005, a real collision demonstrated by the SHAttered project in 2017, chosen-prefix collisions in 2020. Browsers had to force the migration by refusing certificates, because asking politely had not worked.

Three algorithms, three decades, one pattern:

1. The algorithm is adopted broadly, because it is good and it is standard
2. A weakness is discovered, usually years before it becomes practical
3. Migration begins, slowly, and takes another decade
4. The old algorithm is still out there long after everyone agrees it is dead

Every one of those migrations was reactive. The break came first. The move came after, and it was always slower than anyone wanted.

If you want the current state of all of them side by side, our cryptography algorithms cheat sheet lists every algorithm with a plain status and what replaced it.

Why this time is different

Here is the thing worth sitting with.

RSA has not been broken. RSA-2048 has never been publicly factored. Elliptic curve cryptography is not broken either. Diffie-Hellman still works exactly as designed. Every one of these is doing its job correctly today, right now, on the connection you used to load this page.

And we are replacing all of it anyway.

This is the first cryptographic migration in history being run before the break rather than after it. There is no incident to point at, no proof-of-concept, no researcher on stage with a forged certificate. There is only a well-understood piece of mathematics, Shor's algorithm, and the expectation that hardware capable of running it at scale will eventually exist.

That is a genuinely unusual thing for an industry to do, and it explains most of what looks arbitrary about the transition. The deadlines feel invented because there is no incident driving them. The urgency feels overstated because nothing is failing. The names changed because the standards process finished before the threat arrived, rather than in a panic after it.

Two clocks, not one

That said, "RSA has not been broken" needs a footnote, and it arrived five days before this was written.

On 3 September 2026, an engineer named Eric Lu factored RSA-260, a number from the 1991 RSA Factoring Challenge that had stood untouched for 35 years. He announced it by posting one of the two 130-digit prime factors, which anyone can check by division. It is the largest RSA challenge number ever factored, beating RSA-250 from 2020.

Two things about that are worth getting straight, because the coverage has not been careful.

It has nothing to do with quantum computing. RSA challenge numbers fall to classical mathematics, the General Number Field Sieve and its relatives, running on ordinary hardware. Shor's algorithm was not involved. If you saw this framed as a sign that quantum computers are coming for RSA, that framing was wrong.

And the naming is a trap. For numbers in this range, RSA-260 means 260 decimal digits, not 260 bits. That is about 862 bits, which works out to roughly 74 bits of security. The 2048-bit keys protecting real traffic sit at about 107 to 112 bits. Because the difficulty scales logarithmically, factoring RSA-2048 is on the order of ten billion times more work than what Lu just did. Your certificates are fine.

The genuinely odd part is that the method has not been disclosed: no algorithm, no software, no hardware, no running time. That is unusual for a result of this size. When RSA-250 fell in 2020 it came with a paper and a full accounting of the compute. Here the result is trivially verifiable and completely unexplained, which has left a vacuum that speculation has filled. One widely repeated story about how it was done began life as a joke by a colleague, and is now circulating as fact.

But strip the noise away and it makes a useful point, because it shows that RSA faces two clocks running at different speeds:

• Classical erosion is gradual, measurable and predictable. Factoring records creep upward by a few dozen bits a decade, driven by better algorithms and more compute. This is why key sizes kept rising for thirty years before anyone said "post-quantum", and it is why 512-bit and 1024-bit keys were abandoned long before any quantum threat was credible.
• The quantum cliff is not gradual at all. Nothing, nothing, nothing, then everything at once, the moment a machine crosses the threshold Shor's algorithm needs.

The first clock is the one the industry has always known how to read. You watch the records, you add bits, you stay comfortably ahead. The second cannot be managed that way, because there is no partial credit and no early warning in the numbers. Adding bits does not help: a quantum computer that can factor 2048-bit keys can factor 4096-bit keys too.

That is the real argument for moving early. Not that the danger is imminent, but that the usual strategy stops working.

What quantum computing actually breaks

Not everything, and the asymmetry is the whole story.

Shor's algorithm is the problem. It efficiently solves integer factorisation and discrete logarithms, which are precisely the hard problems that RSA, Diffie-Hellman and elliptic curve cryptography are built on. A sufficiently large quantum computer running Shor's would break all three. Not weaken them. Break them.

Grover's algorithm is much less dramatic. It offers a quadratic speedup on unstructured search, which sounds alarming and mostly is not. On the idealised comparison it takes AES-256 down to roughly 128-bit security, which remains comprehensively out of reach. In practice it is even less threatening than that, because Grover's parallelises poorly and is expensive to run, so the real-world speedup falls well short of the theoretical one.

The practical consequence is a clean split:

• Key exchange and digital signatures have to be replaced. This is the asymmetric family, and it is what ML-KEM and ML-DSA exist for.
• Bulk encryption and hashing mostly do not. AES-256 and SHA-256 come through fine. If anything, the advice is simply to prefer the larger sizes.

So if you take one thing from this section: quantum computing is a public-key problem, not an encryption problem in general. The phrase "quantum breaks encryption" is doing a lot of damage to people's mental models.

No, there is no machine that can do this

If the RSA-260 coverage was a mild case of a story getting away from the facts, the reporting on quantum hardware is the severe one. So, bluntly:

No quantum computer that exists today can factor RSA-2048. Not slowly, not expensively, not at all. The obstacle is scale rather than speed: published resource estimates put the requirement several orders of magnitude beyond the largest machines built so far.

Two things make the headlines confusing.

Logical qubits are not physical qubits. When a vendor announces a machine with a thousand qubits, those are physical qubits, and they are noisy. Error correction consumes a large number of them to produce a single reliable logical qubit. The ratio depends heavily on the error-correcting code, and improving it is most of what the field is working on, but the gap between the announced number and the usable number is enormous.

Resource estimates keep falling. The published figures for how many qubits it would take to break RSA-2048 have dropped by more than an order of magnitude over the past several years, as the algorithms got better rather than the hardware. That cuts both ways: it means the estimates are not a fixed target, and it means treating any specific number as settled is a mistake.

The reason it still matters today

If nothing can break RSA now, and nothing will for years, why move?

Because of harvest now, decrypt later. An adversary does not need to break your encryption today. They need only record it. Encrypted traffic captured now can sit on a disk indefinitely and be decrypted the moment the capability arrives.

Which turns the question from "is quantum computing coming" into something you can actually answer. Michele Mosca framed it as an inequality:

If the length of time your data must stay confidential, plus the length of time it takes you to migrate, is greater than the time until a quantum computer arrives, then you are already too late.

That is a filter, not a fear. Apply it honestly and most things fall out immediately. A session cookie has a confidentiality lifetime measured in minutes, so it does not care. A password you will rotate next quarter does not care much either. Medical records, legal files, diplomatic traffic, the identities of sources, industrial designs, anything with a confidentiality requirement measured in decades: those care enormously, and they care now.

It also explains the migration deadlines better than any threat estimate does. They are not set where they are because anyone expects the machine on that date. They are set there because migrating global cryptographic infrastructure has historically taken ten to twenty years, and the clock has to start early enough to finish.

Is PQC on cybersecurity exams?

More than it used to be, and the direction of travel is clear.

Current Security+ material covers post-quantum at a foundational level rather than a mathematical one. You are not expected to explain lattices. You are expected to recognise that quantum computing threatens asymmetric cryptography, to know that NIST standardised algorithms in three categories (key encapsulation, general signatures, hash-based signatures), and to describe harvest now, decrypt later as a concept. All of which is on this page.

Worth noting if you are booking an exam: SY0-801 is expected around late 2026, with SY0-701 retiring roughly six months after it lands. Coverage of this topic is more likely to grow than shrink.

The specific things worth carrying in:

• The names, in both directions, because material written at different times uses different ones
• That Shor's breaks public-key cryptography and Grover's only offers a quadratic speedup, which is the distinction most commonly tested badly
• That AES-256 and SHA-256 are not the problem
• That "post-quantum" means resistant to quantum attack, not running on a quantum computer, which is a genuine and common confusion

The naming is the part most likely to catch you out, because study material written before the standards landed still says Kyber and Dilithium. Both sets of names are correct. Only one set is in the specification.

Conclusion

Kyber is ML-KEM. Dilithium is ML-DSA. SPHINCS+ is SLH-DSA. The algorithms did not change, only the labels did, when they stopped being competition entries and became standards.

Underneath the renaming is something more interesting: an industry replacing cryptography that still works, on a schedule, against a machine nobody has built. Every previous migration waited for the break and then spent a decade catching up. This is the first attempt at getting ahead of one.

For where every algorithm currently stands, including which ones are genuinely broken rather than merely superseded, the cryptography algorithms cheat sheet has the full grid with statuses and sources.