Why algorithm selection matters

Choosing the right post-quantum cryptography algorithm is one of the most critical decisions in your quantum readiness journey. Different algorithms have different trade-offs in security, performance, and implementation complexity.

No One-Size-Fits-All Solution NIST has standardized multiple PQC algorithms because different use cases require different solutions. ML-KEM is ideal for key exchange, ML-DSA for general signatures, and SLH-DSA for high-assurance scenarios. Making the wrong choice can impact security, performance, or compliance.

Organizations face significant challenges in algorithm selection:

PQC-Bench solves this by providing natural language recommendations tailored to your specific use case, sector, and threat model.

What is PQC-Bench

PQC-Bench is an open-source recommendation engine that helps you select the right post-quantum cryptography algorithms. Ask questions in plain English and get expert guidance based on NIST standards and industry best practices.

Natural language queries

Ask questions like "What algorithm should I use for TLS?" or "Which signature algorithm is best for code signing?"

7 sector guides

Pre-built guidance for Financial Services, Healthcare, Government, Critical Infrastructure, Technology, Telecommunications, and Energy sectors.

SNDL threat assessment

Evaluate Store Now, Decrypt Later risks for your data based on sensitivity and retention requirements.

Library readiness checks

Verify if PQC implementations are production-ready in popular cryptographic libraries.

Getting started

Installation

Clone and install PQC-Bench from source:

git clone https://github.com/csnp/pqc-bench.git
cd pqc-bench
pip install -e .

Basic usage

Ask questions in natural language:

# Get algorithm recommendations
pqc-bench recommend "What algorithm should I use for key exchange?"

# Get sector-specific guidance
pqc-bench sector financial

# Assess SNDL threat for a class of data
pqc-bench threat --data-type healthcare_records

# Check library readiness
pqc-bench libraries --production

Common queries

# Key exchange recommendations
pqc-bench recommend "Best algorithm for TLS key exchange?"

# Signature recommendations
pqc-bench recommend "What should I use for document signing?"

# Hybrid mode recommendations
pqc-bench recommend "Should I use hybrid classical + PQC?"

# Protocol impact analysis
pqc-bench recommend "How will PQC affect my TLS performance?"

# Compliance guidance
pqc-bench recommend "What does CNSA 2.0 require by 2030?"

NIST PQC algorithms

NIST has standardized three primary post-quantum cryptography algorithms:

Algorithm Standard Type Primary Use Case
ML-KEM FIPS 203 Key Encapsulation TLS key exchange, encrypted communications
ML-DSA FIPS 204 Digital Signature Code signing, document signing, certificates
SLH-DSA FIPS 205 Digital Signature High-assurance applications, long-term verification
ML-KEM vs ML-DSA ML-KEM (formerly CRYSTALS-Kyber) is for key establishment - creating shared secrets for encryption. ML-DSA (formerly CRYSTALS-Dilithium) is for digital signatures - proving authenticity and integrity. They solve different problems and are often used together.

Algorithm comparison

Property ML-KEM-768 ML-DSA-65 SLH-DSA-128f
Public Key Size 1,184 bytes 1,952 bytes 32 bytes
Private Key Size 2,400 bytes 4,032 bytes 64 bytes
Ciphertext/Signature 1,088 bytes 3,309 bytes 17,088 bytes
Security Level AES-192 equivalent AES-192 equivalent AES-128 equivalent

Sector-specific guidance

PQC-Bench provides tailored recommendations for 7 critical infrastructure sectors:

Financial services

pqc-bench sector financial

Covers PCI-DSS implications, payment system requirements, and regulatory timelines for banks and financial institutions.

Healthcare

pqc-bench sector healthcare

Addresses HIPAA considerations, medical device constraints, and long-term patient data protection requirements.

Industrial OT and SCADA

pqc-bench sector industrial_ot

Covers industrial control systems, SCADA, PLCs and manufacturing, against IEC 62443. Migration urgency is high, and the tool reports a 30 year equipment lifecycle against a 10 year data lifespan, which is the constraint that makes this sector hard.

Energy and utilities

pqc-bench sector energy_utilities

Covers the power grid, smart meters, substations and energy trading, against NERC CIP. Migration urgency is high, with a 25 year equipment lifecycle and a 20 year data lifespan.

Telecommunications and 5G

pqc-bench sector telecommunications

Covers mobile networks from 2G to 5G, core infrastructure and backhaul, against GSMA PQ.03. Migration urgency is high, with a 15 year equipment lifecycle.

The full list of sector names the tool accepts is space_aerospace, automotive, industrial_ot, energy_utilities, healthcare, financial and telecommunications. Run pqc-bench sector --list to see them side by side, and pqc-bench sector --deadlines for the dates.

SNDL threat assessment

The Store Now, Decrypt Later (SNDL) threat is the primary driver for urgent PQC adoption. PQC-Bench helps you assess your SNDL risk:

# List the data profiles the tool knows about
pqc-bench threat --list

# Assess one of them
pqc-bench threat --data-type healthcare_records

The assessment names the gap directly rather than giving a score alone:

SNDL Threat Assessment
══════════════════════════════════════════════════════════════════════
Healthcare Records
──────────────────────────────────────────────────
Description: Patient health information with lifetime confidentiality
Typical lifespan: 100 years
Classification: secret

⚠ AT RISK
CRITICAL: Data needs 102 years of protection, but quantum threat expected in 15
years. You are 87 years behind.

Examples:
  • Medical records
  • Genetic data
  • Mental health records
  • HIV/AIDS status

Recommended Action:
  Prioritize PQC for data at rest and in transit

Recommended Hybrid Mode: X25519Kyber768
Recommended Algorithm: ML-KEM-768

Captured on 2026-08-05 from PQC-Bench 0.3.0. Use --urgency to filter the profile list by urgency level.

SNDL Risk Factors Data with high sensitivity AND long retention periods has the highest SNDL risk. Medical records, financial data, trade secrets, and classified information are particularly vulnerable because they remain valuable for decades.

SNDL risk matrix

Retention Low Sensitivity Medium Sensitivity High Sensitivity
< 5 years LOW MEDIUM MEDIUM
5-10 years MEDIUM HIGH CRITICAL
> 10 years HIGH CRITICAL CRITICAL

Best practices

1. Start with hybrid mode

Combine classical and post-quantum algorithms during transition:

pqc-bench recommend "How do I implement hybrid TLS?"

# Hybrid provides defense-in-depth:
# - Classical algorithm protects against implementation bugs in PQC
# - PQC algorithm protects against future quantum attacks
# - Both must be broken for the system to fail

2. Match algorithm to use case

3. Plan for key size increases

PQC algorithms have larger keys and signatures. Plan for:

4. Follow CNSA 2.0 timelines

pqc-bench recommend "What are the CNSA 2.0 deadlines?"

# Key dates:
# - 2025: Begin planning and pilots
# - 2030: Software/firmware signing must use PQC
# - 2033: All NSS must support PQC

5. Test library readiness

# The whole table, with production readiness and FIPS status
pqc-bench libraries

# Only the libraries rated production ready
pqc-bench libraries --production

# Only the FIPS validated ones
pqc-bench libraries --fips

# Which libraries implement a given algorithm
pqc-bench libraries --algorithm ML-KEM-768

The command reports on the whole set, including OpenSSL, BoringSSL, liboqs and AWS-LC, rather than taking a single library name.

Ready to choose your PQC algorithms?

Get started with PQC-Bench today - it's free, open source, and provides expert guidance for your quantum migration.

View on GitHub Take QRAMM Assessment

Related resources