PQC algorithm families: lattice, hash-based, and the ones that failed

Post-quantum cryptography replaces RSA and elliptic curves with algorithms built on math problems believed to resist both classical and quantum attack. There is no single replacement; instead there are several families with different trade-offs, and NIST's multi-year competition selected a portfolio rather than a single winner. Understanding the families helps you read the standards and make sane deployment choices.

Lattice-based — the mainstream choice

Lattice-based schemes rest on problems like finding short vectors in high-dimensional lattices (Learning With Errors and its structured variants). They offer a strong balance of security, reasonable key and ciphertext sizes, and good performance, which is why they dominate the standards. FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber) is the standard for key encapsulation, and FIPS 204 (ML-DSA, derived from CRYSTALS-Dilithium) is the primary signature standard. For most systems these two are the default post-quantum building blocks.

Hash-based — signatures on the most conservative footing

Hash-based signatures build on nothing more than the security of a hash function — the most well understood and conservative assumption available. FIPS 205 (SLH-DSA, derived from SPHINCS+) is a stateless hash-based signature standard. Its signatures are large and signing is comparatively slow, so it is not the everyday default, but it is invaluable as a diversified backup: because it relies on a completely different assumption than the lattice schemes, a break in lattice math would not touch it.

Code-based and others

Code-based cryptography (built on the hardness of decoding error-correcting codes, as in Classic McEliece) has decades of scrutiny and very strong security confidence, at the cost of very large public keys. It suits niche uses where key size is acceptable in exchange for a conservative assumption. NIST continues to evaluate additional signature schemes to broaden the portfolio beyond lattices.

The families that failed — and why that is reassuring

Not every candidate survived. Rainbow, a multivariate signature scheme, was broken during the NIST process. Most strikingly, SIKE — an isogeny-based key exchange that reached the fourth round as a promising compact option — was broken in 2022 by a classical attack that recovered keys in hours on an ordinary computer. Rather than undermining confidence, these breaks show the value of open, adversarial standardization: the weak schemes were eliminated in public before anyone deployed them at scale.