Post-quantum schemes, compared across standards programmes.
Sizes, benchmarks and security status for signatures and KEMs from NIST, China's ICCS, Korea's KpqC and ISO, updated as specs change and attacks land.
- signature schemes
- 78
- KEMs
- 52
- programmes
- 5
- last data change
- 2026-11-12
Programmes
| Programme | Signatures | KEMs |
|---|---|---|
| NIST post-quantum cryptography standardisation NIST · United States | Standard: ML-DSA, SLH-DSA Selected: Falcon | Standard: ML-KEM Selected: HQC Round 4: Classic McEliece Ended in round 3: 4 schemes |
| Additional digital signature schemes On-ramp · NIST · United States | Round 3: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV Ended in round 2: 5 schemes Ended in round 1: 27 schemes | Not in scope |
| Next-generation commercial cryptographic algorithms NGCC · ICCS · China | Round 1: Aigis-Sig+, BiT, CEDRUS+C, CEDRUSɑ, Chinith, COMPASS-SIG, CS, DARTS, DOVE, Facto-DSA, FlexTree, Galas, GreatWall, Lynxer, MORNING-ATLAS, Octarine, OPS-DSA, Origami, Phoenix, Qing Luan, ReSolveD-ɑ, Rhyme, Shuttle, Sigurd, SQIsign2D-push1/2, SQIsign2D2, SQIsignTriangle, SYDO, Tins, TRINE, TSUOV, UVW signature, VDOO, YuanYang.DSA | Round 1: Aigis-Enc+, Amoeba, BAG-Loong, BAG-Piglet, BIKE-MLThre, BRA, BRQC, BW-KEM, C-Multi-UR-AG, CheetahKEM, COMPASS-KEM, CTL Algorithm, DKEM, DTRU, FLIT, HARE, HEP-QC, LoongKEM, Lore, MAMBA-Frost, MAMBA-Viper, Mithril, Mito, MORNING-Scabbard, NEV, NSS-HQC, NTRE, OAEP-NTRU, Polar-KEM, PolarLAC, QCTM, QIMEN-PIKE, QUBE, Rudraksh2, Scloud+, TRIKE, TriQ-KEM, UVW KEM, Weaver, YuanYang.KEM, ZEN |
| Korean post-quantum cryptography competition KpqC · South Korea | Selected: AIMer, HAETAE | Selected: NTRU+, SMAUG-T |
| ISO/IEC 18033-2 amendment ISO · ISO/IEC · International | Not in scope | Published: Classic McEliece, FrodoKEM |
Latest changes
Full timeline- update
ML-DSA, MAYO and ML-KEM: we moved our builds to the latest upstream code. ML-DSA uses the pq-crystals reference at d35ba3f, with two AVX2 conformance fixes by Gregor Seiler: the stricter infinity-norm check FIPS 204 requires (issue 113) and the rounding of
use_hintwhen the low part is zero (bba9534, reported by Eric Biggers). MAYO uses MAYO-C at 412cb8a, which makes the generic echelon-form routine constant-time; our GFNI/AVX-512 build uses the AVX2 echelon-form code, which this commit does not change. ML-KEM uses mlkem-native v2.0.0. Sizes are unchanged and upstream's known-answer tests pass for every set. We re-benchmarked all three on AWS c8i.4xlarge; the timings do not change beyond run-to-run variation. - update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.
- added to site attack
UVW KEM: Liping Wang (PKC Forum) applies the cubic-jet multiplicity method of Ghoshal, Ishai, Jain and Sun (ePrint 2026/1630) and Weis (ePrint 2026/1984) to shortened public codes, following the shortening approach of Couvreur, Lequesne and Tillich for RLCE. This distinguishes UVW public keys from random codes and refutes the (U+V, U+W) code-distinguishing assumption of the security proof. The post estimates key recovery at 2^53.68, 2^57.75 and 2^61.56 bit operations for UVW-KEM-128, -256 and -512, far below the 128-, 256- and 512-bit targets. Saarinen (ngcc.dev) recovers an equivalent decapsulation key of UVW-KEM-128 from the public key alone in under a minute on 28 cores and confirms the distinguisher on a UVW-KEM-256 key. Key recovery has not been run for UVW-KEM-256 or -512. Yongge Wang (ePrint 2026/2710) predicts the same weakness at every parameter set. All three sets are now flagged broken.