The mathematics behind the new standards

You do not need to be able to prove these problems are hard to use the standards correctly, but knowing the family behind an algorithm helps in reading vendor claims and NIST's own reasoning critically, including why NIST wanted more than one family in its portfolio.

Lattice-based cryptography

Security rests on the difficulty of finding short or closest vectors in a high-dimensional mathematical lattice. ML-KEM and ML-DSA both come from this family — it produced the first two finalized standards because it offers a strong balance of security, performance, and reasonably small key sizes.

Hash-based cryptography

Security rests only on the properties of a cryptographic hash function, a much older, more thoroughly studied kind of assumption. SLH-DSA (from SPHINCS+) uses this approach. It is considered conservative precisely because it depends on so little: trust the hash function, and you trust the signature.

Code-based cryptography

Security rests on the difficulty of decoding a general linear error-correcting code, a problem studied since the 1970s. HQC, selected as a backup KEM in March 2025, comes from this family. NIST chose it deliberately on different mathematics than lattice-based ML-KEM, as a hedge.

That hedge is the point worth remembering: if a future advance, classical or quantum, weakened confidence in lattice-based problems, HQC would not be affected by the same advance, because it does not rely on the same math.

Where a system needs the smallest possible signatures, FN-DSA — the drafted, FALCON-based standard mentioned in the previous lesson — targets that gap using lattice-based math similar to ML-DSA's, with a different structure optimized for compactness.