Introduction
Quantum computers will break RSA and ECDSA. NIST has standardized the replacements. This tool simulates ML-KEM (Kyber, FIPS 203) for key encapsulation and ML-DSA (Dilithium, FIPS 204) for digital signatures, with parameter set details, a Learning With Errors lattice visualization, and a step-by-step simulation of key generation, encapsulation, and signing. It is an educational simulation, not a real implementation, but it shows the exact parameter sizes and protocol flow that production libraries use.
What this tool does
- Simulate ML-KEM (Kyber) key encapsulation across three parameter sets: ML-KEM-512 (Level 1), ML-KEM-768 (Level 3), and ML-KEM-1024 (Level 5), with exact public key, secret key, ciphertext, and shared secret byte sizes from FIPS 203
- Simulate ML-DSA (Dilithium) digital signatures across three parameter sets: ML-DSA-44 (Level 2), ML-DSA-65 (Level 3), and ML-DSA-87 (Level 5), with exact public key, secret key, and signature byte sizes from FIPS 204
- Step through the protocol: key generation, encapsulation (for KEM) or signing (for DSA), and decapsulation or verification, with simulated hex output for each step
- Display the module parameters (k, n, q, eta) for each parameter set, matching the values in the FIPS standards
- Visualize the Learning With Errors (LWE) problem with a 2D lattice diagram showing a lattice point, a noisy observation, and the error vector that makes finding the point hard
- Show the NIST PQC standardization timeline from 2016 (call for submissions) through 2024 (FIPS 203, 204, 205 finalized)
How this tool works
The tool provides an educational simulation of ML-KEM and ML-DSA. It does not implement the actual lattice cryptography (that would require thousands of lines of polynomial arithmetic and NTT code). Instead, it generates random hex strings of the correct byte lengths for each parameter set and walks through the protocol steps.
For ML-KEM, the simulation has three steps. Step 1 (Key Generation) produces a public key and secret key of the correct sizes (e.g. 1184 bytes and 2400 bytes for ML-KEM-768). Step 2 (Encapsulation) produces a ciphertext (1088 bytes for ML-KEM-768) and a shared secret (32 bytes). Step 3 (Decapsulation) recovers the same shared secret from the ciphertext and secret key. The output shows the first 64 hex characters of each value, which is enough to see that they are different random-looking strings.
For ML-DSA, the simulation has three steps: key generation (public and secret key), signing (a signature of the correct byte size), and verification (a boolean result). The signature sizes are large: ML-DSA-65 produces 3309-byte signatures, compared to 64 bytes for Ed25519 or 256 bytes for RSA-2048.
The LWE visualization shows a 2D lattice (a grid of points) with a green dot representing the true lattice point (the secret) and a red dot representing a noisy observation (the lattice point plus a small error). The error vector is drawn as a dashed line. The point of the visualization is that given many noisy observations, finding the original lattice points is the LWE problem, which is believed hard even for quantum computers.
The parameter tables show the exact values from FIPS 203 and FIPS 204: module dimension k, polynomial degree n (always 256), modulus q (3329 for ML-KEM, 8380417 for ML-DSA), and noise bound eta.
How post-quantum cryptography works (FIPS 203, 204, 205)
Post-quantum cryptography (PQC) addresses the threat that quantum computers pose to current public-key cryptography. Shor's algorithm, running on a sufficiently large quantum computer, can factor integers and compute discrete logarithms in polynomial time. This breaks RSA, ECDSA, Ed25519, and Diffie-Hellman. In 2016, NIST launched a standardization process for post-quantum cryptography, receiving 69 candidate submissions. After multiple rounds of evaluation, NIST selected four algorithms in 2022 and finalized three FIPS standards in 2024.
ML-KEM (Module-Lattice-based Key Encapsulation Mechanism), formerly known as CRYSTALS-Kyber, is specified in FIPS 203. It is a KEM, meaning it establishes a shared secret between two parties. The security is based on the Module Learning With Errors (Module-LWE) problem over lattices. Key generation samples a secret vector s and computes a public matrix A and the value t = A*s + e, where e is a small noise vector. Encapsulation picks a random message m, computes ciphertext components c1 = A^T*r + e1 and c2 = t^T*r + e2 + encode(m), and derives the shared secret from m. Decapsulation recovers m from c2 - s^T*c1. The noise vectors are small enough that rounding recovers m correctly.
ML-DSA (Module-Lattice-based Digital Signature Algorithm), formerly known as CRYSTALS-Dilithium, is specified in FIPS 204. It is a signature scheme based on Module-LWE and the Fiat-Shamir paradigm. Key generation samples secret vectors s1 and s2, computes t = A*s1 + s2, and publishes (A, t). Signing computes a commitment w = A*y (where y is a masking vector), derives a challenge c = H(m || w), and computes the response z = c*s1 + y with rejection sampling to ensure z does not leak information about s1. Verification checks that ||A*z - c*t|| is small and that c matches the hash.
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), formerly known as SPHINCS+, is specified in FIPS 205. It is a hash-based signature scheme that relies only on the security of the underlying hash function (no lattice assumptions). It is slower and has larger signatures than ML-DSA but provides a conservative fallback if lattice-based schemes are broken.
The Learning With Errors problem was introduced by Oded Regev in 2005 and has become the foundation for most lattice-based cryptography. The problem: given a random matrix A and a vector b = A*s + e (where s is a secret vector and e is a small noise vector), find s. Without the noise, this is linear algebra (Gaussian elimination). With the noise, it is believed hard even for quantum computers. The homomorphic encryption schemes BFV, BGV, and CKKS are also based on LWE.
NIST also selected Falcon (a lattice-based signature scheme) as a fourth algorithm, but it has not yet been standardized as a FIPS publication due to the complexity of its floating-point implementation.
How to use this tool
- Select an algorithm: ML-KEM (Kyber) for key encapsulation or ML-DSA (Dilithium) for digital signatures
- Select a parameter set. For ML-KEM: 512 (Level 1), 768 (Level 3), or 1024 (Level 5). For ML-DSA: 44 (Level 2), 65 (Level 3), or 87 (Level 5)
- Click Run Next Step to advance through the simulation. For ML-KEM: Key Generation, Encapsulation, Decapsulation. For ML-DSA: Key Generation, Signing, Verification
- Read the output: each step shows the simulated key, ciphertext, or signature as hex (first 64 characters), along with the exact byte sizes from the FIPS standard
- Examine the parameter table: it shows k (module dimension), n (polynomial degree), q (modulus), and eta (noise bound) for the selected parameter set
- Look at the LWE lattice visualization: the green dot is the secret lattice point, the red dot is the noisy observation, and the dashed line is the error that makes the problem hard
- Review the NIST PQC standardization timeline at the bottom of the output to see how these standards were developed from 2016 to 2024
- Click Reset to start over with a different algorithm or parameter set
Real-world examples
ML-KEM-768 key encapsulation simulation
Select ML-KEM and ML-KEM-768 (Level 3, the recommended default). Click Run Next Step three times. Step 1 generates a 1184-byte public key and 2400-byte secret key. Step 2 produces a 1088-byte ciphertext and a 32-byte shared secret. Step 3 decapsulates and recovers the same shared secret. The output confirms the match. In a real deployment, Alice sends the public key to Bob, Bob encapsulates to produce the ciphertext and shared secret, sends the ciphertext back, and Alice decapsulates to get the same secret. This replaces ECDH for post-quantum key agreement.
ML-DSA-65 signature simulation
Select ML-DSA and ML-DSA-65 (Level 3). Click Run Next Step three times. Step 1 generates a 1952-byte public key and 4032-byte secret key. Step 2 signs the input message, producing a 3309-byte signature. Step 3 verifies the signature (result: VALID). Compare the signature size to Ed25519 (64 bytes) or RSA-2048 (256 bytes). ML-DSA signatures are an order of magnitude larger, which impacts bandwidth in protocols like TLS that need to transmit signatures during handshakes.
Comparing security levels across parameter sets
Switch between ML-KEM-512, ML-KEM-768, and ML-KEM-1024. Watch the parameter table change: k goes from 2 to 3 to 4, and the public key grows from 800 to 1184 to 1568 bytes. Level 1 corresponds to AES-128 security, Level 3 to AES-192, and Level 5 to AES-256. ML-KEM-768 is the recommended default for most applications because it balances security and performance. Level 5 is for systems that need the highest security margin.
Understanding the LWE problem via the lattice visualization
Look at the 2D lattice visualization. The green dot is a lattice point (the secret). The red dot is a noisy observation, offset by a small error vector (the dashed line). If you had many such noisy observations, you could try to find the original lattice points by solving a system of noisy linear equations. Without the noise, Gaussian elimination solves it instantly. With the noise, the problem is believed hard even for quantum computers. This is the foundation of ML-KEM and ML-DSA security.
NIST PQC standardization timeline
Scroll to the timeline in the output. It starts in 2016 with NIST's call for submissions, shows 69 candidates in 2017, narrows to 26 in 2019, 7 finalists in 2020, 4 selected in 2022, and 3 FIPS standards finalized in 2024. This eight-year process involved public review, cryptanalysis, implementation benchmarks, and multiple rounds of feedback. The result is the first set of post-quantum standards approved for federal use.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| ML-KEM-512 (Kyber) | Lattice, Level 1 (~AES-128), 800-byte PK | Post-quantum key exchange, lowest security |
| ML-KEM-768 (Kyber) | Lattice, Level 3 (~AES-192), 1184-byte PK | Post-quantum key exchange, recommended default |
| ML-KEM-1024 (Kyber) | Lattice, Level 5 (~AES-256), 1568-byte PK | Post-quantum key exchange, highest security |
| ML-DSA-44 (Dilithium) | Lattice, Level 2, 2420-byte signatures | Post-quantum signatures, lowest security |
| ML-DSA-65 (Dilithium) | Lattice, Level 3, 3309-byte signatures | Post-quantum signatures, recommended default |
| SLH-DSA (SPHINCS+) | Hash-based, FIPS 205, ~50KB signatures | Conservative fallback, no lattice assumptions |
Limitations or considerations
This tool is an educational simulation. It generates random hex strings of the correct byte lengths but does not perform actual lattice cryptography. The shared secrets, signatures, and keys are random values, not real cryptographic outputs. Do not use this tool for any real encryption or signing. For production post-quantum cryptography, use libraries like liboqs, AWS Post-Quantum TLS, or Cloudflare's CIRCL.
The LWE visualization is a 2D simplification. Real ML-KEM and ML-DSA operate on high-dimensional lattices (dimension 256 * k, where k is 2 to 8). The 2D diagram shows the concept (a lattice point plus noise) but cannot represent the actual problem dimensionality.
The tool does not implement SLH-DSA (SPHINCS+, FIPS 205) or Falcon. SLH-DSA is hash-based and has very large signatures (approximately 8 to 50 KB depending on parameters). Falcon is lattice-based but uses floating-point arithmetic for its sampling, which makes standardization more difficult. NIST plans to standardize Falcon separately.
Post-quantum signatures are much larger than classical ones. An ML-DSA-65 signature is 3309 bytes, compared to 64 bytes for Ed25519 or 256 bytes for RSA-2048. This impacts TLS handshake sizes, certificate chains, and protocol design. Hybrid schemes (combining classical and post-quantum algorithms) are being deployed during the transition period to maintain security if either scheme is broken.
The NIST security levels (1, 2, 3, 5) correspond to the difficulty of breaking AES-128, AES-192, and AES-256 respectively. Level 4 is not used in the finalized standards. These levels are based on the best known attacks and may change as cryptanalysis improves.
Frequently asked questions
What is the Learning With Errors (LWE) problem?
LWE is a mathematical problem: given a random matrix A and a vector b = A*s + e (where s is a secret vector and e is a small noise vector), find s. Without the noise e, this is a system of linear equations solvable by Gaussian elimination. The noise makes it hard. Oded Regev introduced LWE in 2005 and showed it is as hard as worst-case lattice problems. ML-KEM and ML-DSA use a variant called Module-LWE, which operates on modules over polynomial rings for efficiency.
When will quantum computers break RSA and ECDSA?
Nobody knows exactly. Current quantum computers have a few hundred physical qubits. Breaking RSA-2048 requires thousands of logical qubits (each requiring many physical qubits for error correction). Estimates range from 10 to 30 years, but the threat is taken seriously now because of 'harvest now, decrypt later' attacks: adversaries can record encrypted traffic today and decrypt it when quantum computers arrive. NIST's standards are being deployed now to mitigate this risk.
What is the difference between ML-KEM and ML-DSA?
ML-KEM (FIPS 203, formerly Kyber) is a key encapsulation mechanism: it establishes a shared secret between two parties, replacing ECDH or RSA key transport. ML-DSA (FIPS 204, formerly Dilithium) is a digital signature algorithm: it signs and verifies messages, replacing ECDSA or RSA-PSS. They serve different purposes. ML-KEM is for confidentiality (key agreement), ML-DSA is for authenticity (signatures).
Why are post-quantum signatures so large?
ML-DSA-65 produces 3309-byte signatures, compared to 64 bytes for Ed25519. Lattice-based signatures include a response vector z and a challenge c, both of which are polynomials with hundreds of coefficients. The size is a tradeoff for quantum resistance. SLH-DSA (SPHINCS+) signatures are even larger (up to 50 KB) because they are hash-based and require Merkle tree authentication paths. Protocol designers are working on ways to reduce the impact, such as certificate compression and TLS extension optimization.
What is a hybrid post-quantum scheme?
A hybrid scheme combines a classical algorithm (like ECDH or ECDSA) with a post-quantum algorithm (like ML-KEM or ML-DSA). The system is secure if either algorithm remains unbroken. This provides protection against both classical attacks (if the PQ algorithm has a flaw) and quantum attacks (if the classical algorithm is broken by Shor's algorithm). Google, Cloudflare, and AWS are deploying hybrid key exchange in TLS to bridge the transition period.
Is ML-KEM related to homomorphic encryption?
Both are based on the LWE problem, but they serve different purposes. ML-KEM is a key encapsulation mechanism for post-quantum key exchange. Fully homomorphic encryption (FHE) schemes like BFV and CKKS use LWE to enable computation on encrypted data. The Homomorphic Encryption Demo shows Paillier, which is partially homomorphic and not lattice-based. The shared foundation is that LWE provides a hard problem that supports both quantum-resistant key exchange and homomorphic computation.
Conclusion
Post-quantum cryptography is the transition from RSA and ECDSA to lattice-based standards that resist quantum attacks. NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in 2024. This tool simulates the parameter sizes and protocol flow for ML-KEM and ML-DSA. For the classical algorithms being replaced, see the ECDSA Signature tool and the Digital Signature Verifier. For hash functions used in SLH-DSA, see the SHA-256 Hash Generator. For related lattice-based cryptography, see the Homomorphic Encryption Demo.