Cybersecurity, Quantum Cryptography

NIST Proposes Dual-Stack PIV Model for Quantum-Safe Credentials

Avatar of Ivy Delaney
June 14, 2026 by Ivy Delaney

The National Institute of Standards and Technology (NIST) is proposing a phased transition to quantum-resistant security for personal identity verification (PIV) credentials, detailed in newly released working drafts. Rather than demanding an immediate overhaul of existing systems, the agency is centering its approach on a dual-stack model that will allow current PIV credentials to coexist with new, post-quantum versions, facilitating incremental deployment. Specifically, the updates outlined in SP Part 1, SP Part 2, and SP focus on integrating the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism into the existing PIV framework. NIST hopes to accelerate the standardization and implementation of post-quantum cryptography in PIV credentials by collaborating with implementers and users throughout the development process, and welcomes feedback on these preliminary materials.

ML-DSA and ML-KEM Integration with PIV Standards

These selections are detailed in newly released working drafts intended to guide the implementation of post-quantum cryptography within the PIV framework, encompassing updates to standards like SP Part 1, SP Part 2, and SP, which outline changes to cryptographic algorithms and key sizes. The agency’s approach deliberately avoids a disruptive overhaul by adopting a dual-stack model that maintains compatibility with current PIV infrastructure while simultaneously introducing support for quantum-resistant alternatives. This strategy allows for incremental deployment, preserving existing classical PIV keys and data objects alongside new references for post-quantum credentials. NIST states that this model “supports backward compatibility and incremental deployment during the transition,” a significant departure from security standard updates that often demand immediate replacement. The released drafts, covering card application namespaces, command interfaces, and cryptographic specifications, are accompanied by a PQC Overview that analyzes necessary specification changes across the PIV profile.

The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.

NIST

The agency is actively soliciting feedback through a public mailing list, subscribe at piv-standards+subscribe [at] list.nist.gov.

More like this
Quantum Research NewsA new cone, FastRényiQKD, boosts quantum key distribution speed
Artificial IntelligenceSandia experts map AI risks for Tri-Valley startups
Quantum CryptographyJolt zkVM switches to lattices for faster, post-quantum proofs
Quantum CryptographyResearchers Prove BB84 Encryption Achieves Top Security Level
Stay current

See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.

Tags:
ML-DSA ML-KEM NIST post-quantum cryptography
Avatar of Ivy Delaney

Ivy Delaney

Ivy Delaney has been working with neural networks and machine learning since the mid-nineties, back when a couple of hidden layers and a long afternoon of training counted as ambitious. She has watched the field go from academic curiosity to the thing quietly running underneath everything, and she brings that long view to quantum computing. For Quantum Zeitgeist she covers the ground where the two fields meet. That means quantum machine learning and the variational algorithms it leans on, and it also means the less glamorous but more interesting story of classical machine learning already doing real work inside quantum machines, decoding error-correcting codes, calibrating noisy hardware and learning the error models that simulators depend on. She writes about the hardware those algorithms have to run on too, and about the post-quantum cryptography scramble that the same hardware has set off. Her stories typically start with the paper, whether that is peer-reviewed work, conference proceedings or an arXiv preprint, with the source linked so you can hold a claim up against the research it came from. She is unimpressed by benchmarks that will not say what they beat, and by demonstrations that only work in the press release.

Latest Posts by Ivy Delaney: