New post-quantum digital signatures: NIST announces the third round candidates

Introduction

On May 14, 2026, the National Institute of Standards and Technology (NIST) published the schemes selected for the third round of the additional process for standardizing post-quantum digital signatures. With the aim of broadening the variety of security assumptions among standardized schemes, this process seeks to complement ML-DSA, FN-DSA, and SLH-DSA with additional solutions.

Evaluation criteria

Similarly to the first process for post-quantum cryptography standardization, the evaluation criteria included, in order of relevance, security, performance, and implementation characteristics. Furthermore, in line with the goal of diversifying security assumptions, it was required that:

• lattice-based candidates provide at least one substantial advantage over both ML-DSA and FN-DSA;
• non-lattice-based candidates provide at least one substantial advantage over SLH-DSA.

As a result, the cryptographic community was strongly encouraged to look for solutions outside lattice-based theory, since some of SLH-DSA’s parameters are considerably easier to match or improve upon.

Selected schemes

In June 2023, at the close of the submission phase, NIST received 50 proposals, of which 40 were selected for the first round of evaluation. The second round saw a further reduction to 14 proposals, while in this latest phase the schemes were further narrowed down to 9. NIST noted that this current selection of candidates was particularly challenging given the high quality of all the proposals analyzed. Below are the main problem families and the number of candidates for each, with a comparison across the various rounds of the process.

In particular, the third round will feature the following candidates.

• Isogenies SQIsign
• Lattices HAWK
• MPC-in-the-head FAEST, MQOM, SDitH
• Multivariate systems UOV, MAYO, SNOVA, QR-UOV

The proposals, along with their specifications and implementations, are freely available on the official NIST page. The rationale behind the selection reflects a balance between security, performance and algorithmic diversity. Among the MPC-in-the-head candidates, FAEST emerged as the one offering the strongest security guarantees, MQOM stood out for its good computational performance, while SDitH contributes to the diversity of the assumption landscape thanks to the well-established Syndrome Decoding Problem for linear codes. Despite some attacks having affected UOV, MAYO, and SNOVA during the second round, NIST chose to keep all four multivariate schemes in the competition, given the long history of the UOV family, the existence of never-broken parameter sets and the promising public key sizes of MAYO and SNOVA. UOV is seen as a candidate for specific application scenarios, while MAYO and SNOVA are seen as general-purpose candidates and QR-UOV as an intermediate solution. HAWK, although lattice-based, was included because it offers shorter signatures than FN-DSA and avoids the use of floating-point arithmetic. SQIsign, finally, offers the smallest combined key and signature sizes among all the candidates. It is worth noting that SQIsign is resilient by design to the attack previously launched against SIKE, an attack that in fact became an opportunity for improvement for SQIsign. Recall that, until it was broken, SIKE was the isogeny-based key encapsulation mechanism under evaluation in NIST’s previous process.

Performance

The chart below shows a comparison of the main parameters of the various digital signature schemes, specifically the size of the public key and signature. It includes pre-quantum schemes, post-quantum schemes already standardized and candidates currently under evaluation. The data shown refer to parameter sets that guarantee a minimum security level of at least 128 bits. For some schemes, multiple parameter sets associated with the same security level are available, each characterized by different trade-offs between key size, signature size and computational cost. For readability, the chart shows only one parameter set per scheme.

It is evident that the public key sizes of UOV and QR-UOV are particularly large. This aspect, although partially offset by a compact signature size, would limit their applicability in various use cases if they were selected. Conversely, but with a similar practical outcome, the MPC-in-the-head schemes feature a short public key but a fairly large signature, similar to SLH-DSA. More balanced in this respect are HAWK, SQIsign, MAYO and SNOVA, all with sizes comparable to or smaller than ML-DSA. To also compare the computational cost of the various schemes, reference was made to data collected by the NIST Signature Zoo project. While each submission to the NIST standardization process includes an overview of computational performance, a meaningful comparison requires that measurements be taken on a common platform. To this end, the aforementioned project collects and publishes benchmarks obtained by running implementations of the various schemes on the same system, based on a 12th-generation Intel processor. One interesting aspect to consider, unfortunately absent from the cited benchmarking, concerns the cost of generating signing and verification keys. In some application contexts this operation can play a decisive role, especially when new key pairs are generated frequently.

The chart shows that, in terms of computational cost for signing and verification operations, SQIsign and UOV exhibit opposite characteristics compared to what was observed for key and signature sizes. SQIsign is among the most computationally expensive schemes, while UOV stands out for its excellent performance. In line with the goals of the standardization process, HAWK can also be seen to perform better than the lattice-based schemes already standardized. Similarly, the MPC-in-the-head and multivariate schemes show lower computational costs than SLH-DSA. This result is not surprising, however, since SLH-DSA prioritizes other properties, such as the absence of structured mathematical assumptions, at the expense of computational efficiency.

Conclusions

The nine schemes selected for the third round represent a diverse algorithmic portfolio, in which each family will still need to address specific challenges before it can aspire to standardization. The multivariate schemes are the ones that showed the greatest uncertainties during the second round. Despite the maturity of UOV’s security assumptions, the series of attacks it has undergone has called its full robustness into question. The MPC-in-the-head candidates, while relying on generally conservative computational assumptions, present complex designs and security proofs whose verification by the cryptographic community is not trivial. In this sense, NIST hopes that any future modifications to these schemes will remain limited, so as not to undermine the analysis work already carried out. HAWK and SQIsign, on the other hand, both rely on relatively young security assumptions which, although they have been studied in depth, require further analysis from the broader community. Finally, across all families, the issue of side-channel attack resistance in implementations remains. With this in mind, NIST expects the third round to be used to consolidate constant-time implementations, so as to guarantee that the theoretical security of these schemes is not undermined in practical applications. [1] Originally, the count of MPCitH proposals was 7, as FAEST was initially included among the symmetric primitives.

This article belongs to a series of contributions, edited by the Telsy Cryptography Research Group, devoted to quantum computing and its implications on Cryptography. For reference to other articles, please refer to the index.

For other articles related to Quantum and Cryptography topics, please refer to the related categories in the blog.

The author

Francesco Stocco, a master’s degree in Mathematics at the University of Padua and the Université de Bordeaux attending the course of study “Algebra Geometry And Number Theory” (ALGANT), joined the Telsy research group in Cryptography at the end of 2020 focusing in particular on issues related to quantum technologies.