Research seriesL3algorithms
The standardized KEM and leading signatures are almost all lattice- or hash-based. A single break in the lattice family would be catastrophic, which is exactly why NIST keeps non-lattice backups. This series is the honest tour of the code-based and multivariate alternatives - McEliece, HQC, BIKE, and the multivariate schemes - and what they cost. Grounded in the primary papers and the fourth-round status.
The standardized key mechanism and both main signatures rest on lattices. If that one assumption family fell, they would fall together — which is exactly why the standards keep non-lattice backups.
McEliece hides a decodable code inside a random-looking matrix, so only the key holder can correct the errors that encryption adds. Its hardness — decoding random codes — has stood since 1978.
Quasi-cyclic codes shrink code-based keys from megabytes to kilobytes. The catch is decoding failures — and it is exactly why NIST chose HQC, with its provable failure bound, over BIKE in 2025.
Multivariate signatures are tiny and fast, built on the hardness of solving quadratic equation systems. But their trapdoor structures are a rich attack surface — and one NIST finalist was broken in a weekend.
The lattice schemes are the efficient default. A non-lattice scheme earns its place when one axis dominates — maximal conservatism, assumption diversity for durable secrets, or a size constraint the lattice profile cannot meet.