Japan's Ministry of Internal Affairs and Communications, the Digital Agency and the Ministry of Economy, Trade and Industry opened a voluntary public comment period on 27 October on the next revision of the CRYPTREC cipher list. The draft would add ML-DSA-44 to the list's post-quantum table even though the scheme sits at Category 1 or 2, the low end of the scale. Comments run until 11 November.
One 128-bit-class exception
CRYPTREC is the project that evaluates and monitors the ciphers Japan recommends for e-government use. Its list has three tiers, and the March 2026 revision added a post-quantum table, "Table 2", whose only public-key entry so far is the ML-KEM key-sharing scheme, alongside AES and the SHA-2 and SHA-3 hash functions. The new draft fills that table out and says Category 3 or above is recommended.
ML-DSA-44 is the only entry below Category 3. The draft rates it Category 2 if the random-number generator used for key generation has at least 192 bits of security strength, and Category 1 if it has 128 to 191 bits. A footnote urges ML-DSA-65 or ML-DSA-87 wherever possible, and strongly where data needs long-term protection.
The accompanying rationale says ML-DSA-44 is likely to be widely used in certificates and DNSSEC. It also notes that Cloudflare recommends it for ordinary use because it performs best of the three ML-DSA sets.
What stays off the list
The draft does not list ML-KEM-512, SLH-DSA at Category 1, AES-128 or SHA-256-class hash functions. The rationale gives two reasons: Table 2 is meant for techniques expected to last beyond the migration, and removing an entry later would affect government procurement and interoperability. Category 1 and 2 block ciphers and hash functions can keep running under the existing list for now. The paper adds that leaving them out does not rule out listing them later.
The draft does add Camellia-192 and -256, SHAKE256 (with a hash length of at least 384 bits), the common cipher modes and ChaCha20-Poly1305 at Category 5.
The clock behind it
The task-force overview puts the migration deadline for government systems at 2035 in principle. Under CRYPTREC's key-strength requirements, 128-bit security is usable until 2040, enters a transition-completion period from 2041, and becomes unusable in stages from 2051.
What is still open
The notice says CRYPTREC has not finished its security evaluation of ML-DSA and SLH-DSA, so the content is not final. The task-force overview expects the evaluation of the relevant US standards, FIPS 204 and 205, to end within fiscal 2026. The ministries ask for comments on Category 1 and 2 ML-DSA and SLH-DSA separately from all other comments, and submissions must be in Japanese.
After the comment period, CRYPTREC will review the responses and revise the list, taking in its separate security evaluations. The notice gives no date for the final revision.