Post-Quantum Cryptography Standardization[1] is a program and competition by NIST to update their standards to include post-quantum cryptography.[2] It was announced at PQCrypto 2016.[3] twenty-three signature schemes and fifty-nine encryption/KEM schemes were submitted by the initial submission deadline at the end of 2017[4] of which sixty-nine total were deemed complete and proper and participated in the first round. Seven of these, of which three are signature schemes, advanced to the third round, which was announced in July 2020.[5]
On August 13, 2024, NIST released final versions of the first three Post Quantum Crypto Standards: FIPS 203, FIPS 204, and FIPS 205.[6]
Academic research on the potential impact of quantum computing dates back to at least 2001.[7] A NIST published report from April 2016 cites experts that acknowledge the possibility of quantum technology to render the commonly used RSA algorithm insecure by 2030.[8] As a result, a need to standardize quantum-secure cryptographic primitives was pursued. Since most symmetric primitives are relatively easy to modify in a way that makes them quantum resistant, efforts have focused on public-key cryptography, namely digital signatures and key encapsulation mechanisms. In December 2016 NIST initiated a standardization process by announcing a call for proposals.[9]
Under consideration were:[10]
(strikethrough means it had been withdrawn)
| Type | PKE/KEM | Signature | Signature & PKE/KEM |
|---|---|---|---|
| Lattice |
|
|
|
| Code-based |
|
|
|
| Hash-based |
|
||
| Multivariate |
|
|
|
| Braid group |
|
||
| Supersingular elliptic curve isogeny | |||
| Satirical submission | |||
| Other |
|
|
Candidates moving on to the second round were announced on January 30, 2019. They are:[34]
| Type | PKE/KEM | Signature |
|---|---|---|
| Lattice | ||
| Code-based | ||
| Hash-based | ||
| Multivariate | ||
| Supersingular elliptic curve isogeny | ||
| Zero-knowledge proofs |
|
On July 22, 2020, NIST announced seven finalists ("first track"), as well as eight alternate algorithms ("second track"). The first track contains the algorithms which appear to have the most promise, and will be considered for standardization at the end of the third round. Algorithms in the second track could still become part of the standard, after the third round ends.[54] NIST expects some of the alternate candidates to be considered in a fourth round. NIST also suggests it may re-open the signature category for new schemes proposals in the future.[55]
On June 7–9, 2021, NIST conducted the third PQC standardization conference, virtually.[56] The conference included candidates' updates and discussions on implementations, on performances, and on security issues of the candidates. A small amount of focus was spent on intellectual property concerns.
| Type | PKE/KEM | Signature |
|---|---|---|
| Lattice | ||
| Code-based |
|
|
| Multivariate |
| Type | PKE/KEM | Signature |
|---|---|---|
| Lattice |
|
|
| Code-based | ||
| Hash-based | ||
| Multivariate |
| |
| Supersingular elliptic curve isogeny | ||
| Zero-knowledge proofs |
|
After NIST's announcement regarding the finalists and the alternate candidates, various intellectual property concerns were voiced, notably surrounding lattice-based schemes such as Kyber and NewHope. NIST holds signed statements from submitting groups clearing any legal claims, but there is still a concern that third parties could raise claims. NIST claims that they will take such considerations into account while picking the winning algorithms.[57]
During this round, some candidates have shown to be vulnerable to some attack vectors. It forces these candidates to adapt accordingly:
On July 5, 2022, NIST announced the first group of winners from its six-year competition.[61][62]
| Type | PKE/KEM | Signature |
|---|---|---|
| Lattice | ||
| Hash-based |
On July 5, 2022, NIST announced four candidates for PQC Standardization Round 4.[63]
| Type | PKE/KEM |
|---|---|
| Code-based | |
| Supersingular elliptic curve isogeny |
On March 11, 2025, NIST announced the selection of a backup algorithm for KEM.[67]
| Type | PKE/KEM |
|---|---|
| Code-based |
On August 13, 2024, NIST released final versions of its first three Post Quantum Crypto Standards.[6] According to the release announcement:
While there have been no substantive changes made to the standards since the draft versions, NIST has changed the algorithms’ names to specify the versions that appear in the three finalized standards, which are:
- Federal Information Processing Standard (FIPS) 203, intended as the primary standard for general encryption. Among its advantages are comparatively small encryption keys that two parties can exchange easily, as well as its speed of operation. The standard is based on the CRYSTALS-Kyber algorithm, which has been renamed ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism.
- FIPS 204, intended as the primary standard for protecting digital signatures. The standard uses the CRYSTALS-Dilithium algorithm, which has been renamed ML-DSA, short for Module-Lattice-Based Digital Signature Algorithm.
- FIPS 205, also designed for digital signatures. The standard employs the SPHINCS+ algorithm, which has been renamed SLH-DSA, short for Stateless Hash-Based Digital Signature Algorithm. The standard is based on a different math approach than ML-DSA, and it is intended as a backup method in case ML-DSA proves vulnerable.
- Similarly, when the draft FIPS 206 standard built around FALCON is released, the algorithm will be dubbed FN-DSA, short for FFT (fast-Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm.
On March 11, 2025 NIST released Hamming Quasi-Cyclic (HQC) as the fifth algorithm for post-quantum asymmetric encryption as used for key encapsulation / exchange.[67] The new algorithm is as a backup for ML-KEM, the main algorithm for general encryption. HQC is a code-based scheme using different math than ML-KEM, thus mitigating possible weaknesses should any be found in the lattice-based ML-KEM.[68] The draft standard incorporating the HQC algorithm is expected in early 2026 with the final in 2027.
NIST received 50 submissions and deemed 40 to be complete and proper according to the submission requirements.[69] Under consideration are:[70]
(strikethrough means it has been withdrawn)
| Type | Signature |
|---|---|
| Lattice | |
| Code-based | |
| MPC-in-the-Head | |
| Multivariate |
|
| Supersingular elliptic curve isogeny | |
| Symmetric-based | |
| Other |
|
NIST deemed 14 submissions to pass to the second round.[129]
| Type | Signature | Technique(s) Used | Hard Problem |
|---|---|---|---|
| Lattice | HAWK[130] | Hash-and-sign | lattice problems |
| Code-based | CROSS[131] | Fiat–Shamir heuristic | Syndrome Decoding Problem |
| LESS[132] | Fiat–Shamir heuristic | Linear Equivalence Problem | |
| MPC-in-the-Head | Mirath[133] (merge of MIRA and MiRitH) | "in the head", Fiat–Shamir heuristic | MinRank (matrix-based) |
| MQOM[134] | "in the head", Fiat–Shamir heuristic | Multivariable Quadratic Problem | |
| PERK[135] | "in the head", Fiat–Shamir heuristic | Permuted Kernel Problem (matrix-based) | |
| RYDE[136] | "in the head", Fiat–Shamir heuristic | Rank Syndrome Decoding Problem (code-based) | |
| SDitH[137] | "in the head", Fiat–Shamir heuristic | Syndrome Decoding Problem (code-based) | |
| Multivariate | MAYO[138] | Unbalanced Oil and Vinegar | Multivariable Quadratic Problem |
| QR-UOV[139] | Unbalanced Oil and Vinegar | Multivariable Quadratic Problem | |
| SNOVA[140] | Unbalanced Oil and Vinegar | Multivariable Quadratic Problem | |
| UOV[141] | Unbalanced Oil and Vinegar | Multivariable Quadratic Problem | |
| Supersingular elliptic curve isogeny | SQIsign[142] | Fiat–Shamir heuristic | Endomorphism Ring Problem |
| Symmetric-based | FAEST[143] | "in the head", Fiat–Shamir heuristic | breaking AES |
