cryptography · 3 min read
Eight algorithms in search of a standard
On the afternoon of July 29, 2022, the SIKE submission team posted a brief note on their public website: Wouter Castryck and Thomas Decru at KU Leuven had broken the algorithm. Their attack ran in Magma, a computer algebra system favoured by number theorists. For the lowest parameter set — the one previously believed to satisfy NIST’s quantum security Level 1 — it finished in 62 minutes on a single CPU core. SIKE had spent six years as a NIST finalist for post-quantum key encapsulation. Against a classical computer, it lasted an hour.
SIKE was a key encapsulation mechanism, not a signature scheme. But its collapse posed a question the main competition had not fully addressed: what happens if a mathematical assumption fails? The three signature schemes NIST standardised in August 2024 — ML-DSA, FN-DSA, and SLH-DSA — rest on two mathematical families: lattices and hash functions. That is not much diversity. That September, NIST opened a parallel track, calling specifically for additional digital signature proposals built on different assumptions.
The process ran through two rounds of elimination. On May 14, 2026, nine candidates advanced to round 3. HAWK — a lattice-based entry, and an ironic addition to an exercise designed to escape lattice dependence — withdrew in July. Eight remain.
The eight divide along four mathematical bloodlines. The multivariate group — MAYO, QR-UOV, SNOVA, and UOV — builds signatures from large systems of polynomial equations, exploiting a problem class that neither classical nor quantum computers can solve efficiently in the worst case. The MPC-in-the-head trio — FAEST, MQOM, and SDitH — proves knowledge of a secret by simulating a multi-party computation internally and committing to the transcript. FAEST builds its proof on the security of AES, which means its assumptions collapse to the same block cipher underlying most of the internet. And then SQIsign stands alone.
SQIsign is isogeny-based, which raises the obvious question after SIKE. The answer is that it uses a different structure: the endomorphism ring of a supersingular elliptic curve, rather than the auxiliary-point technique Castryck and Decru dismantled. The reward is a 177-byte signature at NIST Level 1 — the smallest of any post-quantum signature candidate at that security level — with a 64-byte public key. The cost is speed: signing takes 2.5 seconds in the reference implementation, roughly 500 times slower than ML-DSA. SQIsign 2.0 improved signing by a factor of twenty, cutting it to around 125 milliseconds. It remains the slowest candidate in the room.
The 7th NIST PQC Standardization Conference, planned for late spring or early summer 2027 in Gaithersburg, Maryland, will begin narrowing the field. Final standardization is expected around 2028. The goal is not to replace ML-DSA or SLH-DSA — both remain well-vetted — but to hold alternatives in reserve. The existing PQC portfolio may be excellent. It is also, with one hash-based exception, entirely lattices. That was fine until SIKE taught the field that an hour can change everything.
Sources
- NIST Advances 9 Candidates to the 3rd Round of PQC — NIST CSRC — official round 3 announcement (May 14, 2026), candidate list, 7th Conference timing
- Round 3 Additional Signatures — NIST CSRC — algorithm families, submission specifications
- SQIsign — Wikipedia — signature and key sizes, signing/verification speeds, SQIsign 2.0 improvements
- Single-Core CPU Cracked SIKE in an Hour — The Hacker News — Castryck-Decru attack, 62-minute break on NIST Level 1, SIKE withdrawal
- NIST Advances Nine Post-Quantum Signature Algorithms to Third Round — Quantum Computing Report — round 3 rationale, diversity goals, conference timeline