Quantum Threat & PQC Roadmap

Signatures whose security reduces to the collision and preimage resistance of standard hash functions — no lattice or number-theoretic assumptions.

Security basis

Security of cryptographic hash functions (SHA-2, SHA-3, SHAKE); stateless schemes like SLH-DSA need no secret state between signatures.

NIST status

Standardized: SLH-DSA (FIPS 205, SPHINCS+ family). Stateful hash signatures (LMS, XMSS) appear in NSA CNSA 2.0 for firmware and long-lived roots.

Example schemes

SPHINCS+ → SLH-DSA · LMS / XMSS (stateful, CNSA 2.0)

Strengths

Minimal structural assumptions; well-understood security reduction; valuable as a algorithmic diversity fallback.

Considerations

SLH-DSA signatures are much larger (tens of KB) and signing is slower than ML-DSA; stateful schemes require strict one-time state management.

Typical uses

Archival and long-term trust anchors, conservative fallback signatures, firmware signing (LMS/XMSS), high-assurance backup paths.

Cryptography based on the difficulty of decoding random linear error-correcting codes — one of the oldest PQC research directions (McEliece, 1978).

Security basis

Decoding an arbitrary linear code with added errors is computationally hard; public keys embed structured codes with hidden decoders.

NIST status

Classic McEliece selected in NIST process (very large public keys). HQC key encapsulation continues toward standardization as a lattice alternative.

Example schemes

Classic McEliece · HQC (ongoing KEM standardization)

Strengths

Decades of cryptanalysis for the McEliece framework; conservative security story for code-based KEMs.

Considerations

Public keys can be hundreds of KB (Classic McEliece); smaller ecosystem and library support compared to lattice standards.

Typical uses

Niche high-assurance KEM deployments that tolerate larger keys; research and specialized air-gapped systems.

Schemes built on the difficulty of solving systems of multivariate quadratic equations over finite fields — once a major NIST candidate category.

Security basis

MQ (multivariate quadratic) problem and related structured variants; signature and encryption constructions from polynomial systems.

NIST status

Primary candidates withdrawn after cryptanalysis — e.g. Rainbow broken in 2022. HAWK withdrawn from NIST's additional-signatures process in July 2026 after AI-assisted analysis.

Example schemes

Rainbow (broken) · HAWK (withdrawn 2026)

Strengths

Historical diversity in the NIST evaluation — helped stress-test the standardization process.

Considerations

Not recommended for new deployments; illustrates why migration plans should anchor on finalized FIPS standards and maintain crypto-agility.

Typical uses

None for production today — included for context on why NIST's public evaluation process matters.

Protocols using morphisms (isogenies) between elliptic curves — attracted interest for compact keys before a breakthrough break.

Security basis

Hardness of finding isogenies between supersingular elliptic curves (SIDH/SIKE framework).

NIST status

SIKE broken in 2022 by classical cryptanalysis — removed from consideration. Not suitable for new systems.

Example schemes

SIKE (broken 2022)

Strengths

Demonstrated the value of rigorous public evaluation before widespread deployment.

Considerations

Reminder that PQC remains active research; designs must support algorithm replacement without full system rebuilds.

Typical uses

None for production — historical lesson for crypto-agility planning.