PQC Candidates & Standardisation Lifecycle
How NIST evaluates new post-quantum mechanisms, the nine third-round signature on-ramp candidates (NIST IR 8610, May 2026) across four math families, and the worldwide parallel tracks that decide what actually ships.
Why this matters: ML-KEM, ML-DSA, and SLH-DSA are the algorithms you'll actually deploy; choosing the wrong one means migrating twice.
Start here: Sort and filter the nine candidates for one use case in the Candidate Comparator: it tells ML-KEM-768 apart from Classic McEliece by what each is for, not by name.
For your role
- Developer / Engineer
- Sort and filter the nine signature on-ramp candidates by use case in Step 3, and read the cryptanalysis timeline: choosing the wrong scheme means migrating twice.
- Security Architect
- The Standardisation Lifecycle step advances a candidate through the NIST rounds, and the Future Rounds Forecaster says where each is likely to land: the basis for not betting a design on one scheme.
- Researcher / Academic
- The animated visualisers for MPCitH, multivariate, isogeny and lattice families, the cryptanalysis timeline with every attack and reparameterisation, and the worldwide map of KpqC, CACR and ISO/IEC tracks.
- Certification & Validation Engineer
- The cryptanalysis timeline, with every attack and reparameterisation, and the Standardisation Lifecycle step show which schemes could reach algorithm testing and which are still moving.
- Curious Explorer
- How a new cryptographic algorithm becomes a standard: pick a candidate and advance it through the rounds, watching what an attack does to it along the way.
Standardisation is a rolling process
Post-quantum cryptography is not a single 2024 event. NIST has already published one KEM (FIPS 203 ML-KEM) and two signatures (FIPS 204 ML-DSA, FIPS 205 SLH-DSA) — with a third, FN-DSA (FIPS 206), still in development — picked an alternate KEM, and is mid-flight on a signature on-ramp. Korea, China, and Japan each run parallel national tracks. International bodies (ISO/IEC, IETF, ETSI) layer compatibility and protocol bindings on top. New candidates will keep arriving — the operational question is not which algorithm wins but how fast your stack can absorb the next one.
NIST issues call for proposals for post-quantum public-key encryption, KEM, and signature schemes.
Kyber, Saber, NTRU, Classic McEliece (KEMs); Dilithium, Falcon, Rainbow (signatures). Plus alternates including SIKE, FrodoKEM, BIKE, HQC, SPHINCS+, Picnic, GeMSS.
A classical attack on Supersingular Isogeny Key Encapsulation recovers private keys in under an hour using a single core. SIKE eliminated. SQIsign is built on a different problem and is not affected.
A classical attack on the Rainbow multivariate signature scheme breaks all parameter sets. Rainbow eliminated. UOV (Rainbow's ancestor) was re-submitted in the on-ramp call.
Kyber → ML-KEM, CRYSTALS-Dilithium → ML-DSA, Falcon → FN-DSA, SPHINCS+ → SLH-DSA. The first four PQC standards.
Recognising lattice over-concentration in the signature selections, NIST opens a parallel "on-ramp" call for additional digital signature schemes.
40 submissions accepted for evaluation. First public cryptanalysis period opens.
ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) become final federal standards.
…and counting. The cryptanalysis timeline workshop step shows every event including the 2025 wedge attack and ongoing reparameterisations.
How candidates are validated
NIST evaluates submissions on four axes — security, performance, implementation characteristics, and intellectual property — then opens each round to public cryptanalysis. Attacks are not a failure of the process; they are the point. The 2022 SIKE break, the 2022 Rainbow break, the 2025 Ran wedge attack on UOV-family schemes — each event reshaped the field, eliminated some candidates, and forced others to reparameterise.
Reductions to a well-studied hard problem; tight ROM / QROM proofs; resistance to known attacks and side-channels.
Key, signature, and ciphertext sizes; signing / verification / encapsulation cost; behaviour under constrained-device budgets.
Constant-time feasibility, hardware portability, side-channel resistance, ease of integration with existing TLS / X.509 / PKCS#11 stacks.
Submission teams disclose patent claims; encumbered schemes face higher scrutiny. History: RSA's patent expiry shaped early PKI deployments.
When the Ran wedge attack revealed an exterior-product weakness in characteristic-2 UOV parameter sets, three of UOV's four parameter sets fell below their security target, MAYO-2 lost ~30 bits, and most SNOVA parameter sets broke. The process worked: NIST surfaced the attack, teams proposed odd-characteristic reparameterisations, the surviving constructions are now better-understood.
Four math families on the table
The nine third-round candidates (NIST IR 8610, May 2026) break down into four mathematical families. Diversity across families is the entire point — if lattice math falls, the portfolio survives. The workshop's Family Math Explainer step shows animated visualisations of each construction.
MPC-in-the-Head
FAEST · MQOM · SDITHProve knowledge by simulating a multi-party computation inside a hash transcript.
Security reduces to symmetric primitives (AES, hash functions) or well-studied combinatorial problems (syndrome decoding, MQ). No novel number-theoretic assumptions required.
Three candidates kept to cover the strongest security foundations: FAEST (AES), SDitH (coding theory, studied since 1970s), MQOM (MQ, best performance of MPCitH category).
Signatures are inherently large (kilobytes) because they encode a simulated-computation transcript. MQOM still needs further QROM proof maturation.
Multivariate
UOV · MAYO · QR-UOV · SNOVAHidden-structure quadratic systems — tiny signatures, big public keys.
Inverting a system of multivariate quadratic polynomials with a trapdoor (Oil and Vinegar, introduced 1999). Hardness rests on the MQ problem and the secrecy of the oil/vinegar partition.
Potentially smallest signatures of any PQC family. SNOVA odd-characteristic reparameterisation reaches sub-FN-DSA combined sizes. No attack has broken the underlying UOV construction itself.
The 2025 Ran wedge attack and the Furue–Ikematsu small-field attack each pushed 3 of UOV's 4 parameter sets below their security targets, hit MAYO-2 by ~30 bits, and broke most SNOVA parameter sets. QR-UOV (odd characteristic) survived unscathed.
Isogeny
SQISIGNSupersingular elliptic-curve isogenies — the smallest signature + public key of any PQC candidate.
Computing isogenies between supersingular elliptic curves and determining their endomorphism rings. Among the newest cryptographic assumptions.
At NIST Category 1, SQIsign signatures are 148 B and combined pk+sig fits in a single Ethernet frame — transformative for IoT, certificates, firmware. Round 2 redesign (higher-dimensional isogenies) cut signing time ~20×.
Isogeny cryptography is young. The 2022 SIKE break (auxiliary torsion-point attack) is the cautionary backdrop — SQIsign avoids that structure, but the math is hard to audit. Constant-time signing remains an open implementation challenge.
Lattice
HAWKSame family as ML-DSA / FN-DSA — but integer-only sampling, no floating point.
Search Module Lattice Isomorphism Problem (smLIP) and One-More-Shortest-Vector Problem (omSVP). Newer than the standard SVP/LWE/SIS family but related.
HAWK eliminates Falcon's floating-point Gaussian-sampling pain — pure integer arithmetic on a rank-2 module lattice. Compact 555 B signatures at Category 1, smaller than both ML-DSA and FN-DSA, and easier to implement in constant time on constrained hardware.
omSVP definition discrepancy required refinement during Round 2. Advances in solving smLIP variants exist but do not currently apply to HAWK's cyclotomic number fields — flagged for further community analysis.
Worldwide parallel processes
NIST is not the only show. Korea, China, and Japan each run national tracks; international bodies (ISO/IEC, IETF, ETSI) layer compatibility and protocol bindings on top; and regional regulators (BSI, ANSSI) overlay deployment guidance. Different jurisdictions will ship different combinations of these outputs — your migration plan needs to know which ones apply to you.
KpqC (Korea PQC Competition)
South KoreaNational PQC standardisation competition run by KISA + Korean Cryptography Forum.
Launched in 2022 as Korea's own PQC competition, modelled on the NIST process. Round 2 concluded in 2024 with KEM finalists (NTRU+, SMAUG, REDOG, PALOMA, Layered ROLLO-I, NCC-SIGN-style) and signature finalists. KpqC explicitly aims for algorithm independence from US standards in case of cryptopolitical fragmentation. Several KpqC submissions are also NIST on-ramp candidates (e.g., HAETAE), creating a deliberate two-track validation path.
CACR PQC Competition (China)
ChinaChinese Association for Cryptologic Research national PQC contest, complemented by OSCCA standards work.
CACR ran a national PQC competition starting 2018, with multiple algorithm tracks (PKE/KEM, signature). National winners include LAC (lattice KEM, withdrew from NIST after Round 2), AIGIS (signature), and several lattice + multivariate finalists. The State Cryptography Administration (OSCCA) operates a separate standards track for SM-series cryptography (SM2/SM3/SM4/SM9) and is expected to publish PQC-extended SM specs. China's position is publicly independent of NIST — domestic deployments are mandated to use SAC/GB national standards rather than FIPS.
ISO/IEC JTC 1 / SC 27
InternationalInternational standards body adopting NIST PQC outputs as ISO/IEC standards.
SC 27 / WG 2 is integrating NIST PQC algorithms into the ISO/IEC 18033 (encryption) and ISO/IEC 14888 (digital signatures) families. Active drafts: ISO/IEC 14888-4 (ML-DSA), ISO/IEC 18033-7 (ML-KEM), with SLH-DSA and FN-DSA in evaluation. ISO adoption is the gating step for many jurisdictions that pin national procurement to ISO references rather than US FIPS — making this the workhorse track for global PQC propagation.
ReferenceJapanese government cryptographic algorithm evaluation programme.
Internet protocol integration — PQC bindings to TLS, IPsec, SSH, X.509, JOSE/COSE.
European telecom-focused technical reports and migration guidance.
Horizon Europe-funded research projects on PQC migration (PQ-REACT, QSAFE, PQ-CAR, etc.).
German federal IT security agency; publishes Technical Guidelines (TR-02102) covering recommended algorithms.
French national cybersecurity agency; mandatory hybrid PQC for high-sensitivity systems.
What's coming next
NIST signals a longer expected timeline for any multivariate standardisation, and is unlikely to standardise any of them without a further round of evaluation. Lattice (HAWK), isogeny (SQIsign), and the MPCitH candidates are on the faster track — earliest projected standardisation window is 2027. Korea targets 2029. ISO adoption will follow.
HAWK, SQIsign, and at least one MPCitH scheme (likely FAEST or MQOM) are positioned for earliest standardisation.
Multivariate (UOV / MAYO / QR-UOV / SNOVA) — needs another evaluation round to settle post-wedge-attack parameters.
KEM diversification beyond ML-KEM + HQC; long-tail review cycles for hardness assumptions that mature into the standardisation pipeline.
Check off all sections and mark this reading done.
Related modules
- Cryptographic APIs & Developer LanguagesSame migration phase · Shares Falcon, HQC, ML-DSA
- Quantum ThreatsSame track · Foundations · Same migration phase · Shares Falcon, HQC, ML-DSA
- PQC Governance & PolicyShares Falcon, HQC, ML-DSA
- Architect Quantum ImpactSame migration phase · Shares Falcon, ML-DSA, ML-KEM
Check your understanding
8 questions on PQC Candidates & Lifecycle, each with its answer and the reason.
Take the quizNext step
Apply it: take the readiness assessmentThe assessment scores your own estate against what this module covers.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.