NIST's Next Signature Standards: Inside the 9 Candidates Competing to Join ML-DSA in Round 3

Published by: QubitChain Research
URL: qubitchain.io/blog/nist-additional-signature-schemes-round-3-2026
Category: Post-Quantum Cryptography, NIST Standards
Reading Time: Approximately 14 minutes
Last Updated: August 2026

FIPS 204, 205, and the draft FIPS 206 aren't the end of NIST's post-quantum signature work. They're the first wave. In parallel with finalizing those, NIST has been running an entirely separate standardization track since 2022, specifically because relying on only two mathematical families, lattices and hashes, worried the agency enough to go looking for more. As of May 2026, that track has a shortlist: nine candidates, spanning four mathematical foundations none of which is ML-DSA's or Falcon's.

Definition: The Additional Digital Signatures Process

A NIST standardization track, separate from and running alongside the main PQC effort that produced FIPS 203-206, specifically soliciting post-quantum signature schemes built on mathematical assumptions other than structured lattices. Documented in NIST IR 8528 (Round 1 results) and NIST IR 8610 (Round 2 results, published May 2026).

Here's what's actually in contention, and why it matters for anyone building infrastructure meant to outlast the current standard set.

Why NIST Went Looking for a Fourth Family in the First Place

ML-DSA and FN-DSA are both lattice-based. They share the same general mathematical neighborhood, structured lattices, even though their specific hardness assumptions (Module-LWE/Module-SIS for ML-DSA, NTRU for Falcon) aren't identical. SLH-DSA is the odd one out, hash-based, depending on nothing lattices touch. That gives NIST two genuinely independent foundations. It doesn't give them three or four, and the agency has been explicit that assumption diversity, not just performance, is the point of reopening the call.

The process started in 2022 with a public request for submissions. Round 1 drew 40 candidates. NIST IR 8528, published in 2024, documented the cut to 14 for Round 2: CROSS, FAEST, HAWK, LESS, MAYO, Mirath, MQOM, PERK, QR-UOV, RYDE, SDitH, SNOVA, SQIsign, and UOV. On May 14, 2026, NIST released IR 8610, cutting that field to nine for Round 3: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, and UOV. The next PQC Standardization Conference, where Round 3 results get discussed publicly, is scheduled for the first half of 2027.

Nine names is a lot to track. They sort cleanly into four families, and the family matters more than the acronym.

Isogeny-Based: SQIsign, the Compactness Champion With a History Lesson Attached

SQIsign's security comes from the difficulty of finding maps, called isogenies, between supersingular elliptic curves that share a specific algebraic structure. It's a genuinely different kind of elliptic curve math than what ECDSA uses; ECDSA's vulnerability comes from the discrete logarithm problem within a single curve's point group, while isogeny cryptography is about relationships between curves, a structure Shor's algorithm doesn't have a known efficient attack against.

The headline number is startling: SQIsign has the smallest combined public key and signature size of any candidate in the entire process, with signatures around 148 bytes at the lowest security category, smaller than a Falcon signature and not far off ECDSA's original 71 bytes. Between the first and second rounds, the design team improved signing speed by roughly 20 times and verification speed by roughly 6 times, alongside a cleaner security argument in the random oracle model.

It's worth being direct about why isogeny cryptography earns extra scrutiny rather than automatic enthusiasm. SIDH and SIKE, the previous generation of isogeny-based candidates, were considered serious contenders in NIST's original PQC process, through three full rounds, before a 2022 classical (not even quantum) attack broke them completely, one of the most dramatic reversals in the standardization's history. SQIsign is a structurally different construction than SIDH, and NIST's Round 3 notes flag the specific remaining open items directly: fully constant-time signing isn't solved yet, side-channel resistance needs more work, and the underlying endomorphism-ring assumption needs broader community cryptanalysis before anyone should treat it as settled. That's not a reason to dismiss SQIsign. It's the exact reason isogeny schemes get an extra round of scrutiny that lattice and hash-based schemes, with a longer track record, don't need as urgently.

Lattice-Based: HAWK, the Scheme That Isn't Dilithium or Falcon

HAWK is the only lattice-based candidate left in Round 3, and that alone makes it worth understanding, since it means it's the only one of the nine that shares a mathematical neighborhood with ML-DSA and FN-DSA at all.

Critically, it's not the same neighborhood. HAWK's security rests on the one-more-shortest-vector problem and the search module lattice isomorphism problem, both distinct from the Module-LWE and Module-SIS assumptions underlying ML-DSA and Falcon. That distinction matters precisely because it means HAWK isn't just "another Dilithium." A future weakness discovered specifically in MLWE-based constructions wouldn't necessarily touch HAWK's isomorphism-based approach, even though both are broadly "lattice" schemes. HAWK is a hash-and-sign construction, similar in spirit to Falcon's approach but built to sidestep the floating-point Gaussian sampling that our earlier coverage of Falcon's "Sleeping Falcon" side-channel research identified as a genuine implementation risk, producing signatures smaller than Falcon's at a comparable security level. For the full status of Falcon's own standardization, see our FIPS 206 status guide.

Multivariate: MAYO, UOV, QR-UOV, and SNOVA

Four of the nine survivors are multivariate schemes, built on the difficulty of solving systems of multivariate quadratic equations over finite fields. The core trick underlying most of them is a structure called Oil and Vinegar: the private key holder knows a hidden split between two sets of variables that makes solving the system easy, while an outside observer sees only a system that looks intractably nonlinear.

UOV (Unbalanced Oil and Vinegar) is the most direct, conservative implementation of that idea, and one of the longest-studied multivariate schemes in the cryptographic literature, which counts for something in a field where track record is scarce. MAYO modifies UOV specifically to shrink key sizes, which have historically been UOV's weak point, while inheriting UOV's genuinely compact signatures; it's not as fast as UOV, but the size tradeoff has kept it in serious contention across all three rounds so far. QR-UOV applies quasi-cyclic structure to reduce key size further, though NIST's own Round 2 report noted it needs further optimization work before its performance profile is fully competitive. SNOVA extends the oil-and-vinegar approach into a different algebraic structure aimed at improving the size-versus-security tradeoff further.

The family's core appeal is track record: oil-and-vinegar constructions have been studied since the 1990s, well before post-quantum cryptography was a distinct field, giving multivariate schemes a depth of cryptanalytic history that newer families haven't had time to accumulate.

MPC-in-the-Head: FAEST, MQOM, and SDitH

This is the family most likely to be unfamiliar even to people who've followed the other NIST tracks closely, and it's arguably the most conceptually distinct of the four. MPC-in-the-Head, and the related VOLE-in-the-Head technique FAEST specifically builds on, constructs a signature scheme whose security reduces to nothing more exotic than the security of a symmetric-key cipher, the same category of primitive as AES.

That's a genuinely striking security profile. It means these schemes don't depend on the hardness of a number-theoretic problem, a lattice problem, or an isogeny problem at all; they depend on the same kind of assumption underlying block ciphers that have been battle-tested for decades. The tradeoff is size and computational overhead: MPCitH-style schemes tend to produce larger signatures and require more memory than lattice-based alternatives, the price for building security out of the simplest possible primitive rather than a more specialized mathematical structure.

Why Five Candidates Didn't Make It

CROSS, one of the fourteen Round 2 candidates, is a useful case study in how NIST's elimination reasoning actually works, because the report on it is unusually direct: security analysis of CROSS's Fiat-Shamir-based construction improved between rounds, addressing an open theoretical question, but NIST concluded its performance profile, similar in spirit to SLH-DSA's small-key, large-signature tradeoff, didn't offer enough of a distinct advantage to justify keeping it alongside FAEST, MQOM, and SDitH, which occupy similar territory with what NIST judged to be a better overall profile. LESS, Mirath, PERK, and RYDE were the other four eliminated between Round 2 and Round 3. None of the eliminations reflect a security break; they reflect NIST narrowing a genuinely crowded field down to the candidates it judges most likely to reach production readiness.

What This Means If You're Building Infrastructure Today

None of these nine will be a finalized FIPS standard before 2027 at the absolute earliest, and the Round 3 evaluation period itself typically runs another one to two years beyond that before final publication, based on how long the original three-standard process took from Round 3 to FIPS. Nothing here changes what you should be building on right now: ML-DSA, with SLH-DSA as an independent-assumption backup, remains the correct production choice.

What this process should change is how you think about your architecture's ability to adapt. NIST explicitly designed this second track because it isn't confident two mathematical families are enough for the long term, and the agency's own history, three finalized standards, a fourth in draft, and now nine more candidates in active evaluation, is direct evidence that "the post-quantum standard" is not a fixed target. A protocol that hard-coded ML-DSA into its consensus rules without a mechanism to add whatever emerges from this process in 2027 or 2028 will face the exact same retrofit problem currently facing ECDSA-based chains, just on a longer timeline.

This is precisely the argument for cryptographic agility as a protocol-level requirement rather than a nice-to-have. QubitChain.io's governance-controlled algorithm registry exists specifically so that whichever of these nine candidates, or their eventual successors, NIST finalizes can be added through a governance vote rather than a hard fork. Full architecture: qubitchain.io/whitepaper. Full comparison across every major blockchain's signature scheme: qubitchain.io/compare.

Frequently Asked Questions

Q: What are NIST's Round 3 post-quantum signature candidates?

A: On May 14, 2026, NIST advanced nine candidates to Round 3 of its Additional Digital Signatures process: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, and UOV. These are separate from and would supplement the already-finalized FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), and draft FIPS 206 (FN-DSA), documented in NIST Internal Report 8610.

Q: Why does NIST need more post-quantum signature standards beyond ML-DSA and Falcon?

A: ML-DSA and FN-DSA are both lattice-based, sharing a broadly similar mathematical neighborhood even with different specific hardness assumptions. NIST reopened its call for additional signature schemes specifically to diversify beyond lattice and hash-based (SLH-DSA) foundations, reducing the risk that a single future cryptanalytic breakthrough could compromise multiple standards at once.

Q: What is SQIsign and why is it significant?

A: SQIsign is an isogeny-based post-quantum signature scheme with the smallest combined public key and signature size of any Round 3 candidate, around 148 bytes at the lowest security category. Its security rests on the difficulty of finding isogenies (structured maps) between supersingular elliptic curves. Between rounds, its signing speed improved roughly 20-fold and verification roughly 6-fold, though NIST has flagged side-channel resistance and further cryptanalysis of its endomorphism-ring assumption as Round 3 priorities.

Q: Is isogeny-based cryptography safe given the SIDH and SIKE break?

A: SIDH and SIKE, earlier isogeny-based NIST candidates, were broken by a classical (non-quantum) attack in 2022 after reaching the third round of NIST's original PQC process. SQIsign is a structurally different construction, but this history is precisely why NIST is subjecting it to additional scrutiny in Round 3, including calls for broader community cryptanalysis of its underlying assumptions before any standardization decision.

Q: What is HAWK and how is it different from ML-DSA?

A: HAWK is the only lattice-based candidate remaining in NIST's Round 3 Additional Digital Signatures process. Unlike ML-DSA, which relies on the Module Learning With Errors and Module Short Integer Solution problems, HAWK's security rests on the one-more-shortest-vector problem and the search module lattice isomorphism problem, distinct hardness assumptions within the broader lattice family. It produces signatures smaller than Falcon at comparable security levels.

Q: What is MPC-in-the-Head and which candidates use it?

A: MPC-in-the-Head (and the related VOLE-in-the-Head technique) is a signature construction method whose security reduces only to the security of a symmetric-key cipher, similar in category to AES, rather than a number-theoretic or lattice problem. FAEST, MQOM, and SDitH, three of the nine Round 3 candidates, are built on this approach. The tradeoff is larger signatures and higher memory usage compared to lattice-based alternatives.

Q: When will NIST finalize any of the Round 3 candidates?

A: No standardization date has been set. The next PQC Standardization Conference, where Round 3 results will be discussed publicly, is scheduled for the first half of 2027. Based on the timeline of NIST's original three-standard process, final publication of any Round 3 winner would likely occur one to two years after that conference at the earliest. See more questions at qubitchain.io/faq.

References