Post-quantum cryptography
Post-quantum cryptography replaces RSA/ECC (breakable by Shor's algorithm) with math believed hard for quantum computers. NIST finalized the first standards in 2024; migration is now a compliance program, not just research. Diversify families - one broken family (SIKE, 2022) shouldn't sink the whole stack.
By subarea
Lattice-based
Schemes: ML-KEM (Kyber, FIPS 203), ML-DSA (Dilithium, FIPS 204), FN-DSA (Falcon, draft)
Status: primary NIST standards
Note: The workhorses: good sizes/speed. KEM for key exchange, DSA for signatures. Basis of most migration.
Status: primary NIST standards
Note: The workhorses: good sizes/speed. KEM for key exchange, DSA for signatures. Basis of most migration.
Hash-based signatures
Schemes: SLH-DSA (SPHINCS+, FIPS 205), XMSS / LMS (RFC 8391 / 8554, stateful)
Status: standardized
Note: Most conservative security (rests only on hash functions); larger/slower. Stateful variants (XMSS/LMS) power firmware signing and QRL's ledger.
Status: standardized
Note: Most conservative security (rests only on hash functions); larger/slower. Stateful variants (XMSS/LMS) power firmware signing and QRL's ledger.
Code-based
Schemes: Classic McEliece, HQC (selected 2025 as backup KEM)
Status: McEliece added to ISO asymmetric-ciphers standard (Jun 2026); HQC selected by NIST as the non-lattice backup KEM (Mar 2025, IR 8545) - NIST did NOT standardize Classic McEliece
Note: Decades-old, very conservative; huge public keys (McEliece); ~47 years unbroken for real parameters. BUT 2025-26 is an unusually active cryptanalysis season - subexponential distinguishers AND key-recovery attacks that broke reduced-parameter TII challenge instances, plus a live proposal-vs-rebuttal on whether the newest route reaches real params. Still NO practical break of NIST/ISO parameter sets (unlike SIKE, which genuinely fell in 2022). NIST noted mceliece460896 dipped below its Category-3 claim (still >= Cat 2). See the McEliece cryptanalysis watch below for the dated, graded blow-by-blow.
Status: McEliece added to ISO asymmetric-ciphers standard (Jun 2026); HQC selected by NIST as the non-lattice backup KEM (Mar 2025, IR 8545) - NIST did NOT standardize Classic McEliece
Note: Decades-old, very conservative; huge public keys (McEliece); ~47 years unbroken for real parameters. BUT 2025-26 is an unusually active cryptanalysis season - subexponential distinguishers AND key-recovery attacks that broke reduced-parameter TII challenge instances, plus a live proposal-vs-rebuttal on whether the newest route reaches real params. Still NO practical break of NIST/ISO parameter sets (unlike SIKE, which genuinely fell in 2022). NIST noted mceliece460896 dipped below its Category-3 claim (still >= Cat 2). See the McEliece cryptanalysis watch below for the dated, graded blow-by-blow.
Isogeny-based
Schemes: SIKE (BROKEN), newer isogeny research
Status: SIKE broken (2022, classical attack)
Note: Cautionary tale: an entire NIST finalist fell to a classical attack - why diversification matters.
Status: SIKE broken (2022, classical attack)
Note: Cautionary tale: an entire NIST finalist fell to a classical attack - why diversification matters.
Symmetric / hybrid
Schemes: AES-256, SHA-2/3, hybrid classical+PQC KEX
Status: symmetric already quantum-resistant with larger keys (Grover -> double key size)
Note: AES-256/SHA-384 need no replacement (only larger sizes); hybrids run classical+PQC together during migration.
Status: symmetric already quantum-resistant with larger keys (Grover -> double key size)
Note: AES-256/SHA-384 need no replacement (only larger sizes); hybrids run classical+PQC together during migration.
NIST standards
| ID | Name | Date | Note |
|---|---|---|---|
FIPS 203 | ML-KEM (Kyber) | 2024-08 | Key encapsulation. |
FIPS 204 | ML-DSA (Dilithium) | 2024-08 | Primary signature. |
FIPS 205 | SLH-DSA (SPHINCS+) | 2024-08 | Hash-based signature. |
HQC selection | NIST backup KEM | 2025 | Non-lattice KEM for diversification. |
Cryptanalysis watch
A dated, graded log of the moving cryptanalysis front - most active on Classic McEliece. Headlines routinely misread a 'distinguisher' (tells a scheme's code from random - never a claimed secret) as a 'break' (recovers the key). SIKE is the only listed scheme with a real, practical full break. TII = Technology Innovation Institute challenge instances (reduced parameters), NOT the NIST/ISO parameter sets.
| Date | Scheme | Work | Result |
|---|---|---|---|
| 2022-07 | SIKE (isogeny) | Castryck-Decru | FULL classical break in ~hours on a laptop; killed the NIST-finalist SIDH/SIKE outrightfact |
| 2025 (Eurocrypt) | Classic McEliece | Randriambololona - the syzygy distinguisher (arXiv 2407.15740) | First SUBEXPONENTIAL structural distinguisher for alternant/Goppa codes incl. Classic McEliece params; heuristic (graded Betti-number prediction). Best-paper. Distinguisher, not key recovery.demo |
| 2026-06 | Classic McEliece | Briaud-Lemoine-Randriambololona-Tillich (eprint 2026/1232) | Heuristic SUBEXPONENTIAL KEY-RECOVERY via rank-2 matrices in the code of quadratic relations (even characteristic); recovers the secret Goppa structure on some instances. Real-param impact open.demo |
| 2026-06 | Classic McEliece | Hemmert - higher-order vanishing (eprint 2026/1339) | KEY-RECOVERY that broke previously-unbroken TII challenges; conjectured to reach Classic McEliece params but at complexity FAR above their security levels (improves prior KR only).demo |
| 2026-08 | Classic McEliece | Ghoshal-Ishai-Jain-Sun - 'PIR Meets McEliece' (eprint 2026/1630) | QUASIPOLYNOMIAL distinguisher (n^O(log n)); applies to ALL NIST param sets, improves the syzygy distinguisher asymptotically, but impractical to run (smallest case ~2^27-dim solve). Distinguisher, NOT a break.interp |
| 2026-08 | Classic McEliece | Vedenev - distinguishing->key-recovery for subfield subcodes of GRS (eprint 2026/1747) | Turns distinguishing into KEY-RECOVERY; experimentally validated on Goppa/F4; CONJECTURED to extend to binary Goppa (unproven for real params).interp |
| 2026 | Classic McEliece | Saarinen - hold-out KR cost model (eprint 2026/1786) | Conditional cost model for a prospective hold-out key-recovery: ~2^146-2^235 gates depending on normalization - i.e. still infeasible at real params.estimate |
| 2026 (~Nov) | Classic McEliece | Apon - AG lower bound REBUTTING 2026/1747 (eprint 2026/1810) | Algebraic-geometry lower bound arguing Vedenev's route is INFEASIBLE for real params: >2^1500 bit ops at Cat-5 mceliece8192128. The counter-argument to the newest key-recovery claim (present both).interp |
| 2023-26 | Classic McEliece | various (e.g. Springer 2026) | Implementation SIDE-CHANNEL attacks on decapsulation / Goppa-polynomial loading (Hamming-weight leakage) - break specific implementations, not the math; mitigated by constant-time code.demo |
Bottom line. No practical structural break of NIST/ISO Classic McEliece parameter sets as of late 2026. What HAS happened: reduced-parameter TII challenges fell; distinguishers reach all params but are impractical; a subexponential key-recovery direction exists but its reach to real params is conjectural and actively contested (Vedenev 2026/1747 vs Apon 2026/1810). Binary-Goppa McEliece remains ~47 years unbroken for deployed parameters - watch this space.
Curated + graded knowledge base, aggregated from the research corpus and refreshed by a scheduled tracker. Grades: fact demo target estimate interp. The live feed is machine-collected and unverified. contact resistant@tuta.com