The post-quantum toolkit
The mathematics behind the new standards
A working vocabulary for lattice-based, hash-based, and code-based cryptography, and why NIST wanted more than one family.
7 min read · 7 min 26 sec film
What you'll be able to do
- Name the three mathematical families this lesson covers: lattice-based, hash-based, and code-based.
- State which standard belongs to which family.
- Explain, at a plain-language level, why a hash-based signature scheme is considered a conservative choice.
Lesson film
Watch: The mathematics behind the new standards
Three mathematical families, one of which you can watch being built out of nothing but a hash function.
7 min 26 sec · 10 scenes
7 min 26 sec, narrated by your browser's voice. Captions and a full transcript are below — nothing here needs sound.
You do not need to prove these problems are hard in order to use the standards correctly.
With the player focused: Space plays or pauses, ← → seek ten seconds, Home restarts, M toggles narration.
Full transcript
1. Why the family matters
2. What this buys you
3. Lattice-based
4. Hash-based, built live
5. Code-based
6. The three, side by side
7. Why a portfolio
8. Trade-offs, not a ranking
9. The remaining gap
10. Takeaway
The written lesson
You do not need to be able to prove these problems are hard to use the standards correctly, but knowing the family behind an algorithm helps in reading vendor claims and NIST's own reasoning critically, including why NIST wanted more than one family in its portfolio.
- Lattice-based cryptography
- Security rests on the difficulty of finding short or closest vectors in a high-dimensional mathematical lattice. ML-KEM and ML-DSA both come from this family — it produced the first two finalized standards because it offers a strong balance of security, performance, and reasonably small key sizes.
- Hash-based cryptography
- The security analysis depends on properties of the underlying cryptographic hash function and the correct construction and implementation. SLH-DSA (from SPHINCS+) is stateless and uses this conservative family of assumptions. It is not a guarantee that every hash choice or implementation is secure.
- Code-based cryptography
- Security rests on the difficulty of decoding a general linear error-correcting code, a problem studied since the 1970s. HQC, selected as a backup KEM in March 2025, comes from this family. NIST chose it deliberately on different mathematics than lattice-based ML-KEM, as a hedge.
The hedge is mathematical diversity: a weakness specific to a lattice assumption would not automatically break a code-based scheme. A shared implementation or protocol failure could still affect deployments using both.
| Family | Standard(s) | Relative maturity of the assumption |
|---|---|---|
| Lattice-based | ML-KEM, ML-DSA | Studied intensively since the 2000s |
| Hash-based | SLH-DSA | Rests only on hash function properties, among the most conservative assumptions available |
| Code-based | HQC (standard in progress) | Studied since the 1970s; different structure than lattice problems |
FN-DSA, the FALCON-based signature standard still under development, targets compact signatures using lattice-based mathematics. Treat its expected size advantage as a design consideration to revisit when the standard and product support are ready, not as a current universal choice.
A lattice can be pictured as a high-dimensional grid; the selected schemes use carefully defined hard problems related to finding or distinguishing short error patterns, not a simple two-dimensional shortest-path puzzle. A code-based scheme asks an attacker to decode a deliberately noisy codeword without a secret shortcut. A hash-based signature combines one-way functions in a structured tree. These are intuition aids, not proofs of security.
Primary reading and claim sources
Publication status checked on the date shown. Draft guidance can change.
- FIPS 203: Module-Lattice-Based Key-Encapsulation MechanismNIST · Final standard · Sections 3.1 and 8; Table 3 (parameter sizes) · checked 2026-09-26
- FIPS 204: Module-Lattice-Based Digital Signature StandardNIST · Final standard · Table 2 (key and signature sizes) · checked 2026-09-26
- FIPS 205: Stateless Hash-Based Digital Signature StandardNIST · Final standard · checked 2026-09-26
- Selected Algorithms for StandardizationNIST · Current project status · checked 2026-09-26
Marking a lesson complete only updates this browser.