NIST: the standards body behind AES, SHA, and post-quantum cryptography

NIST — the National Institute of Standards and Technology — is a non-regulatory agency of the US Department of Commerce, originally chartered in 1901 to standardize physical measurement (weights, time, physical constants). Its Computer Security Division took on cryptography because the US federal government needed algorithms every agency could rely on, and someone had to specify exactly which ones and how.

NIST publishes two kinds of documents that matter here. A FIPS (Federal Information Processing Standard) is mandatory for US federal systems and is where the actual algorithms live — AES, SHA-2, SHA-3, the post-quantum algorithms. The SP 800 series (Special Publications) is guidance rather than a hard mandate — how to use those algorithms safely, key management practices, random number generation requirements. Almost nothing here is unique to US government use: because NIST's process and output are free, public, and rigorously reviewed, the rest of the world adopted them as the de facto global baseline too.

NIST doesn't design algorithms in-house and declare them standards. For its three biggest decisions — a replacement for DES, a replacement for SHA-1/SHA-2, and a response to the quantum threat — it ran open, multi-year public competitions instead: anyone could submit a candidate, and the entire cryptographic research community was invited to attack every submission in public.

This matters for a reason beyond fairness: a design nobody could break after years of open cryptanalysis by the world's best cryptographers is a far stronger trust signal than a design reviewed only behind closed doors — exactly the property that made the Dual_EC_DRBG story (covered later on this page) so damaging when it broke that pattern.

The full list is long, but almost everything covered in this catalog's Learn modules traces back to one of these.

Each competition responded to a specific, different threat. AES replaced DES because DES's 56-bit key had become exhaustively searchable — a computational weakness, not a design flaw. SHA-3 was selected not because SHA-2 had been broken (it hadn't, and still hasn't), but as a structural hedge: SHA-1's break in the mid-2000s showed an entire hash function family can share a fatal weakness, so NIST wanted a backup built on a fundamentally different internal structure (a sponge construction) ready before it was ever needed. The post-quantum competition responds to Shor's algorithm, covered in its own module — a future quantum computer would break RSA, Diffie-Hellman, and ECC's discrete-log math entirely, not just weaken it.