Post-Quantum Cryptography Lounge

The Post-Quantum Cryptography Lounge provides a searchable summary of the candidates submitted to the NIST Post-Quantum Cryptography Standardisation process that can be easily filtered.
(Example: filter for lattice, code, multi-variate quadratic, SIDH, other …)

A searchable table and responsive charts for the NIST analysis of the mandatory optimised software implementations is available at the following links:

NIST Software Analysis – Signatures

NIST Software Analysis – Encryption

NIST Software Analysis – KEM

Going forward we aim to collate software and hardware implementation results for the submitted candidates.

Information is currently taken from the pqc-forum. All further contributions and updates are welcome. Please email: info AT safecrypto.eu

Useful Links:
Security estimates for LWE- and NTRU-based candidates can be found at: https://estimate-all-the-lwe-ntru-schemes.github.io

CandidateSubmittersTypeSub-typeClassStatusAnalysisClaimed SecurityNotes
BIKE
Zip file
Nicolas Aragon /Paulo S.L.M. Barreto /Slim Bettaieb /Loic Bidoux /Olivier Blazy /Jean-Christophe Deneuville /Phillipe Gaborit /Shay Gueron /Tim Guneysu /Carlos Aguilar Melchor /Rafael Misoczki /Edoardo Persichetti /Nicolas Sendrier /Jean-Pierre Tillich /Gilles ZemorCode Quasi-Cyclic Moderate Density
Parity-Check (QC-MDPC) codes
KEMRound 1CPAClarification added on KAT files
Classic McEliece
Zip file
Daniel J. Bernstein /Tung Chou /Tanja Lange /Ingo von Maurich /Rafael Misoczki /Ruben Niederhagen /Edoardo Persichetti /Christiane Peters /Peter Schwabe /Nicolas Sendrier /Jakub Szefer /Wen WangCode Binary Goppa codesKEMRound 1CCA2
Ramstake
Zip file
Alan SzepieniecOtherKEMRound 1CCA
HQC
Zip file
Carlos Aguilar Melchor /Nicolas Aragon /Slim Bettaieb /Loïc Bidoux /Olivier Blazy /Jean-Christophe Deneuville /Philippe Gaborit /Edoardo Persichetti /Gilles ZémorCode Quasi-cyclic codes,
BCH codes
KEMRound 1CCA2
Ouroboros-R
Zip file
Carlos Aguilar Melchor /Nicolas Aragon /Slim Bettaieb /Loic Bidoux /Olivier Blazy /Jean-Christophe Deneuville /Phillipe Gaborit /Adrien Hauteville /Gilles ZemorCode Rank metric codesKEMRound 1CPA
RQC
Zip file
Carlos Aguilar Melchor /Nicolas Aragon /Slim Bettaieb /Loic Bidoux /Olivier Blazy /Jean-Christophe Deneuville /Phillippe Gaborit /Gilles ZemorCode Rank Quasi-Cyclic codesKEMRound 1CCA2
RLCE-KEM
Zip file
Yongge WangCode Random Linear Code Based
Public Key Encryption (RLCE)
KEMRound 1ATTACKEDCCA2-Group 1 parameters insecure
RaCoSS
Zip file
Kazuhide Fukushima /
Partha Sarathi Roy
/Rui Xu /Shinsaku Kiyomoto /Kirill Morozov / Tsuyoshi Takagi
Code Random code based
Signature scheme
SignatureRound 1ATTACKEDsEUF-CMAThe low-weight hash function used in RaCoSS is not secure.
RaCoSS can quickly sign any message for any public key with the
Specified RaCoSS parameters, without knowing the secret key.
QC-MDPC KEM
Zip file
Atsushi Yamada /Edward Eaton /Kassem Kalach /Philip Lafrance /Alex ParentCode Quasi-Cyclic Moderate Density
Parity-Check (QCMDPC)
KEMRound 1CCA2
LEDAkem
Zip file
Marco Baldi /Alessandro Barenghi /Franco Chiaraluce /Gerardo Pelosi /Paolo SantiniCode Quasi-Cyclic Low Density
Parity-Check (QC-LDPC)
KEMRound 1CCA
LEDApkc
Zip file
Marco Baldi /Alessandro Barenghi /Franco Chiaraluce /Gerardo Pelosi /Paolo SantiniCode Quasi-Cyclic Low Density Parity Check
(QC-LDPC) codes
EncryptionRound 1CCA2
DAGS
Zip file
Gustavo Banegas /Paulo S.L.M. Barreto /Brice Odilon Boidje /Pierre-Louis Cayrel /Gilbert Ndollane Dione /Kris Gaj /Cheikh Thiecoumba Gueye /Richard Haeussler /Jean Belo Klamti /Ousmane N'diaye /Duc Tri Nguyen /Edoardo Persichetti /Jefferson E. RicardiniCode Quasi-Dyadic Generalized
Srivastava codes
KEMRound 1CCAStructural attacks on parameter sets 1, 3 and 5- *patched with parameter modification*
RankSign
Zip file
Nicolas Aragon /Phillipe Gaborit /Adrien Hautevillle /Olivier Ruatta /Gilles ZemorCode LRPC codeSignatureRound 1WITHDRAWNCCA2
McNie
Zip file
Lucky Galvez /Jon-Lark Kim /Myeong Jae Kim /Young-Sik Kim /Nari LeeCode McEliece Niederreiter cryptosystemsEncryptionRound 1ATTACKEDCCA2Known Attack: Security can be reduced by a factor of 2, revised
parameter set given by the authors.
LOCKER
Zip file
Nicolas Aragon /Olivier Blazy /Jean-Christophe Deneuville /Philippe Gaborit /Adrien Hauteville /Olivier Ruatta /Jean-Pierre Tillich /Gilles ZemorCode Ideal-LRPC codesKEMRound 1CCA2-Minor implementation problem: fixed
-Key recovery attack stronger than originally anticipated
LAKE
Zip file
Nicolas Aragon /Olivier Blazy /Jean-Christophe Deneuville /Philippe Gaborit /Adrien Hauteville /Olivier Ruatta /Jean-Pierre Tillich /Gilles ZemorCode Ideal-LRPC codesKEMRound 1CPA-Minor implementation problem: fixed
-Key recovery attack stronger than originally anticipated
Edon-K
Zip file
Danilo Gligoroski /Kristian GjosteenCode McEliece public key
scheme variant
KEMRound 1WITHDRAWNCCA2Attack recovers secret key from ciphertext
pqsigRM
Zip file
Wijik Lee /Young-Sik Kim /Yong-Woo Lee /Jong-Seon NoCode punctured Reed-Muller
(RM) Code
SignatureRound 1EUF-CMAPrivate key can be recovered for 128- and 192-bit parameter sets *patched*
NTS-KEM
Zip file
Martin Albrecht /Carlos Cid /Kenneth G. Paterson /Cen Jung Tjhai /Martin TomlinsonCode McEliece, Niederreiter variant
KEMRound 1CCA
BIG QUAKE
Zip file
Alain Couvreur /Magali Bardet /Elise Barelli /Olivier Blazy /Rodolfo Canto-Torres /Philippe Gaborit /Ayoub Otmani /Nicolas Sendrier /Jean-Pierre Tillich Code quasi-cyclic Goppa codesKEMRound 1CCA2
Picnic
Zip file
Greg Zaverucha / Melissa Chase /David Derler /Steven Goldfeder /Claudio Orlandi /Sebastian Ramacher /Christian Rechberger /Daniel SlamanigOtherSignatureRound 1sEUF-CMA
Gravity-SPHINCS
Zip file
Jean-Phillippe Aumasson /Guillaume EndignouxHashSignatureRound 1EUF-CMAFault injection attack
SPHINCS+
Zip file
Andreas Hulsing /Daniel J. Bernstein /Christoph Dobraunig /Maria Eichlseder /Scott Fluhrer /Stefan-Lukas Gazdag /Panos Kampanakis /Stefan Kolbl /
Tanja Lange /Martin M Lauridsen /Florian Mendel /Ruben Niederhagen /Christian Rechberger /Joost Rijneveld /Peter Schwabe
HashSignatureRound 1EUF-CMA-Fault injection attack
-Concerns over security proof
Odd Manhattan
Zip file
Thomas PlantardLatticeStandardEncryptionRound 1CPANot CCA secure-*patched*
NTRU Prime
Zip file
Daniel J. Bernstein /Chitchanok Chuengsatiansup /Tanja Lange /Christine van VredendaalLatticeRingKEMRound 1CCA2
Three Bears
Zip file
Mike HamburgLatticeModuleKEMRound 1CCA
CRYSTALS- KYBER
Zip file
Peter Schwabe /Roberto Avanzi /Joppe Bos /Leo Ducas /Eike Kiltz /Tancrede Lepoint /Vadim Lyubashevsky /John M. Schanck /Gregor Seiler /Damien StehleLatticeModuleKEMRound 1CCA2Concerns surrounding proof of IND-CPA security
LOTUS
Zip file
Le Trieu Phong /Takuya Hayashi /Yoshinori Aono /Shiho MoriaiLatticeStandardKEM
Encryption
Round 1CCA2CCA attack-*patched*
NTRUEncrypt
Zip file
Zhenfei Zhang /Cong Chen /Jeffrey Hoffstein /William WhyteLatticeRingKEM
Encryption
Round 1CCA2
pqNTRUsign
Zip file
Zhenfei Zhang /Cong Chen /Jeffrey Hoffstein /William WhyteLatticeRing
Module
SignatureRound 1EUF-CMAVulnerable to CMA attack - *patched*
SABER
Zip file
Jan-Pieter D'Anvers /Angshuman Karmakar /Sujoy Sinha Roy /Frederik VercauterenLatticeModuleKEMRound 1CCA
Compact LWE
Zip file
Dongxi Liu /Nan Li
Jongkil Kim /Surya Nepa
LatticeStandardEncryptionRound 1ATTACKEDCCA2Secret key can be recovered from ciphertext
Ding Key Exchange
Zip file
Jintai Ding /Tsuyoshi Takagi /Xinwei Gao /Yuntao WangLatticeRingKEMRound 1CPA
KINDI
Zip file
Rachid El BansarkhaniLatticeRingKEM
Encryption
Round 1CCA
Lizard
Zip file
Jung Hee Cheon /Sangjoon Park /Joohee Lee /Duhyeong Kim /Yongsoo Song /Seungwan Hong /Dongwoo Kim /Jinsu Kim /Seong-Min Hong /Aaram Yun /Jeongsu Kim
Haeryong Park /Eunyoung Choi /Kimoon kim /Jun-Sub Kim /Jieun Lee
LatticeStandard, RingKEM
Encryption
Round 1CCA2
Round2
Zip file
Oscar Garcia-Morchon /Zhenfei Zhang /Sauvik Bhattacharya /Ronald Rietman /Ludo Tolhuizen /Jose-Luis Torre-ArceLatticeStandard, RingKEM
Encryption
Round 1CCA-MERGED with Hila5 to become Round5
-Concerns surrounding proof of the IND‐CPA security
-Potential CCA attack
LIMA
Zip file
Nigel P. Smart /Martin R. Albrecht /Yehuda Lindell /Emmanuela Orsini /Valery Osheter /Kenny Paterson /Guy PeerLatticeRingKEM
Encryption
Round 1CCAConcerns surrounding rejection sampling analysis - patch proposed
EMBLEM and R.EMBLEM
Zip file
Minhye Seo /Jong Hwan Park /Dong Hoon Lee /Suhri Kim /Seung-Joon LeeLatticeStandard, RingEncryptionRound 1CPA
NewHope
Zip file
Thomas Poppelmann /Erdem Alkim /Roberto Avanzi /Joppe Bos /Leo Ducas /Antonio de la Piedra /Peter Schwabe /Douglas StebilaLatticeRingKEMRound 1CCA
Titanium
Zip file
Ron Steinfeld /Amin Sakzad /Raymond K. ZhaoLatticePolyKEM
Encryption
Round 1CCA
CPA
HILA5
Zip file
Markku-Juhani O. SaarinenLatticeRingKEMRound 1CPAMERGED with Round2 to become Round5
qTESLA
Zip file
Nina Bindel /Sedat Akleylek /Erdem Alkim /Paulo S.L.M. Barreto /Johannes Buchmann /Edward Eaton /Gus Gutoski /Juliane Kramer/ Patrick Longa /Harun Polat / Jefferson E. Ricardini /Gustavo ZanonLatticeRingSignatureRound 1EUF-CMA
CRYSTALS- DILITHIUM
Zip file
Vadim Lyubashevsky/ Leo Ducas / Eike Kiltz /Tancrede Lepoint/ Peter Schwabe /Gregor Seiler /Damien StehleLatticeModuleSignatureRound 1SUF-CMA
KCL (OKCN/AKCN/CNKE)
Zip file
Yunlei Zhao /Zhengzhong jin /Boru Gong /Guangye SuiLatticeStandard, RingKEM
Encryption
Round 1CCA
LAC
Zip file
Xianhui Lu /Yamin Liu /Dingding Jia /Haiyang Xue /Jingnan He /Zhenfei ZhangLatticePolyKEM
Encryption
Round 1CCAFailure rate potentially worse than expected
DRS
Zip file
Thomas Plantard/ Arnaud Sipasseuth/ Cedric Dumondelle/ Willy SusiloLatticeStandardSignatureRound 1ATTACKEDEUF-CMAStatistical attack to recover partial information on secret key
FrodoKEM
Zip file
Michael Naehrig /Erdem Alkim /Joppe Bos /Leo Ducas /Karen Easterbrook /Brian LaMacchia /Patrick Longa /Ilya Mironov /Valeria Nikolaenko /Christopher Peikert /Ananth Raghunathan /Douglas StebilaLatticeStandardKEMRound 1CCA
Giophantus
Zip file
Koichiro Akiyama /Yasuhiro Goto /Shinya Okumura /Tsuyoshi Takagi /Koji Nuida /Goichiro Hanaoka /Hideo Shimizu /Yasuhiko IkematsuLatticeStandardEncryptionRound 1ATTACKEDCPADistinguishing attack that breaks the claimed IND‐CPA security-addressed in revised paper
Claimed security levels revised
NTRU-HRSS-KEM
Zip file
John M. Schanck /Andreas Hulsing /Joost Rijneveld /Peter SchwabeLatticeRingKEMRound 1CCA2
FALCON
Zip file
Thomas Prest / Pierre-Alain Fouque /Jeffrey Hoffstein /Paul Kirchner /Vadim Lyubashevsky /Thomas Pornin /Thomas Ricosset /Gregor Seiler /William Whyte /Zhenfei ZhangLatticeRingSignatureRound 1EUF-CMA
Lepton
Zip file
Yu Yu /Jiang ZhangLPN (Lattice/Code)KEMRound 1CCA
DME
Zip file
Ignacio Luengo / Martin Avendano / Michael MarcoMultivariatePKKEMRound 1CPAConcern regarding security level achieved
SRTPI
Zip file
Joseph Peretz /
Nerya Granot
Multivariate QuadraticEncryptionRound 1WITHDRAWNCCA2Broken under CPA: decryption operations are affine
DualModeMS
Zip file
J.-C. Faugère /L Perret /J RyckeghemMultivariate Quadratic
HFESignatureRound 1EUF-CMA
LUOV
Zip file
Ward Beullens /
Bart Preneel /
Alan Szepieniec /
Frederik Vercauteren
Multivariate QuadraticSignatureRound 1EUF-CMA
GeMSS
Zip file
A. Casanova /J.-C. Faugère /G. Macario-Rat
J Patarin /L Perret /J Ryckeghem
Multivariate QuadraticHFESignatureRound 1EUF-CMA
MQDSS
Zip file
Simona Samardjiska /
Ming-Shing Chen /
Andreas Hulsing /
Joost Rijneveld /
Peter Schwabe
Multivariate QuadraticSignatureRound 1EUF-CMA
DME
Zip file
Ignacio Luengo /
Martin Avendano / Michael Marco
Multivariate QuadraticPKSignatureRound 1EUF-CMAConcern regarding security level achieved
HiMQ-3
Zip file
Kyuang-Ah Shim /
Cheol-Min Park /
Aeyoung Kim
Multivariate QuadraticHFESignatureRound 1EUF-CMAFlaw in EUF-CMA security proof
Gui
Zip file
Jintai Ding /
Ming-Shen Chen /
Albrecht Petzoldt /
Dieter Schmidt /
Bo-Yin Yang
Multivariate QuadraticHFESignatureRound 1EUF-CMAParameter set 1 vulnerability
Rainbow
Zip file
Jintai Ding \Ming-Shing Chen \Albrecht Petzoldt \Dieter Schmidt \Bo-Yin YangMultivariate QuadraticSignatureRound 1EUF-CMA
SRTPI
Zip file
Joseph PeretzMultivariate Quadratic (or MQE)SignatureRound 1WITHDRAWNsEUF-CMABroken under KMA: signature secret key operation is linear
CFPKM
Zip file
O. Chakraborty /J. C-Faugère /L Perret /Multivariate
Quadratic
KEMRound 1ATTACKEDCPAknown attack - breaks IND-CPA security for CFPKM128, CFPKM182 parameter sets.
Attack on shared secret: shared secret can be recovered from the public values within the scheme
WalnutDSA
Zip file
Derek Atkins /
Iris Anshel /
Dorian Goldfeld /
Paul E. Gunnells
Other
Braids
Group theoretic OWFSignatureRound 1EUF-CMA-Multiple patched attacks
-Scheme may also be vulnerable to 'square root' attacks.
RVB
Zip file
C. B. Roellgen /
G. Brands
Other
Chebyshev polynomials
KEMRound 1WITHDRAWNCCA2ATTACKED: secret key can be quickly computed from a public key. Uses LLL.
HK17
Zip file
Juan Pedro Hecht /
Jorge Alejandro Kamlofsky
Other
Hypercomplex numbers
Key Agreement ProtocolRound 1WITHDRAWNCCA2ATTACKED: using invertibility property of the public key
Doesn't fall into a particular category. Issue with protocol
No secret randomness.
Mersenne-756839
Zip file
Divesh Aggarwal /
Antoine Joux /
Anupam Prakash /
Mikos Santha
Lattices/Other








KEMRound 1CCA
Guess Again
Zip file
Vladimir Shpilrain /
Mariya Bessonov /
Alexey Gribov /
Dima Grigoriev
Other
Random Walk
EncryptionRound 1ATTACKEDCCA2ATTACKED: For KATs, the message can be recovered from ciphertext without private key
Post-Quantum RSA Encryption
Zip file
Daniel J Bernstein /Josh Fried /Naia Heninger /Paul Lou /Luke ValentaOther
RSA
EncryptionRound 1CCA2
Post-Quantum RSA Signature
Zip file
Daniel J Bernstein /Josh Fried /Naia Heninger /Paul Lou /Luke ValentaOther
RSA
SignatureRound 1EUF-CMA
SIKE
Zip file
David Jao /
Reza Azarderakhsh /
Matthew Campagna /
Craig Costello /
Luca De Feo /
Basil Hess /
Amir Jalali /
Brian Koziel /
Brian LaMacchia /
Patrick Longa /
Michael Naehrig /
Joost Renes /
Vladimir Soukharev /
David Urbanik
SIDHKEM
Encryption
Round 1CCA
CPA
-Quantum attacks overestimated
-Potential lower-running-cost attack