Algorithm Families
Post-quantum cryptography is not one technique but a portfolio. Five mathematical families survived years of analysis to reach standardization or active candidacy, each resting on a different hard problem. Understanding the families — and why diversity among them matters — is the foundation for sound migration planning.
The Five Families
Quantum-resistant schemes draw their security from problems believed hard even for a large quantum computer. The leading families are:
- Lattice-based — built on LWE / Module-LWE and SIS / NTRU. Small keys and signatures, fast operations. Powers
ML-KEM,ML-DSA, andFalcon. - Hash-based — security rests only on the underlying hash function. Signatures only. Very conservative and well understood; signatures are large.
- Code-based — hardness of decoding random linear codes. McEliece is unbroken for 45+ years but has huge keys; HQC and BIKE use structured codes for smaller keys.
- Multivariate — solving systems of multivariate quadratic equations (MQ). Compact signatures, large keys, but a turbulent track record (Rainbow broken 2022).
- Isogeny-based — isogenies between supersingular elliptic curves. Tiny keys, but SIKE was broken in 2022; research continues with SQIsign and CSIDH.
PQC is traditionally understood through five families: lattice-based, hash-based, code-based, multivariate, and isogeny-based. In recent years the NIST additional-signatures call has also drawn in directions such as MPC-in-the-head and symmetric-key constructions, so the "five families" framing is better treated as a classic guided-tour framework than a complete taxonomy of candidates.
At a Glance
| Family | Hard problem | KEM / Sig | Key + sig size profile | Maturity |
|---|---|---|---|---|
| Lattice | LWE / Module-LWE, SIS, NTRU | Both | Small–moderate; balanced | Standardized (FIPS 203/204), Falcon pending |
| Hash-based | Preimage/collision resistance of a hash | Sig only | Small keys, large signatures | Standardized (FIPS 205, SP 800-208) |
| Code-based | Syndrome decoding of random linear codes | KEM | Huge keys (McEliece) or moderate (HQC/BIKE) | HQC selected 2025 (standard forthcoming); McEliece long-studied |
| Multivariate | MQ — multivariate quadratics | Sig (mostly) | Tiny sigs, large keys | Niche / higher-risk; UOV in onramp |
| Isogeny | Supersingular isogeny path-finding | KEM (was), Sig (SQIsign) | Tiny keys | SIKE broken; SQIsign in onramp |
Why Cryptographic Diversity Matters
NIST selected lattice schemes for most slots because they offer the best size-and-speed balance. But concentrating the entire ecosystem on a single hard problem is risky: a future breakthrough against lattices — analogous to the 2022 breaks of SIKE and Rainbow — could compromise many deployed systems at once.
For this reason NIST deliberately standardized a non-lattice signature (SLH-DSA, hash-based) and continues to advance a code-based KEM (HQC) as a backup to lattice-based ML-KEM. The strategic lesson from SIKE and Rainbow is concrete: schemes with elegant, compact mathematics can fall suddenly. A resilient deployment keeps a diversified fallback and the agility to swap algorithms quickly.
How to Read the Families
- Default to standardized lattice schemes for general use (small, fast, balanced).
- Hold a hash-based signature as the most conservative long-term signing option.
- Watch the backups — code-based HQC for KEM diversity — and treat multivariate and isogeny schemes as promising but not yet load-bearing.
Lattice-Based →
LWE, Module-LWE, NTRU — the workhorse of PQC standards.
Hash-Based →
Conservative signatures built only on hash functions.
Code-Based →
Syndrome decoding; McEliece, HQC, BIKE.
Multivariate →
MQ-based signatures and the Rainbow cautionary tale.
Isogeny-Based →
Tiny keys, the SIKE break, and SQIsign research.
Standards & references
- NIST Post-Quantum Cryptography project — the standardization effort spanning all PQC families.
- FIPS 203 (ML-KEM) — the lattice-based KEM standard.
- FIPS 204 (ML-DSA) — the lattice-based signature standard.
- FIPS 205 (SLH-DSA) — the hash-based signature standard.
- Resources — full standards register
算法家族
后量子密码不是单一技术，而是一个组合方案。五大数学家族在多年分析后脱颖而出，进入标准化或活跃候选阶段，各自建立在不同的困难问题之上。理解这些家族，以及家族间多样性的意义，是制定稳健迁移规划的基础。
五大家族
抗量子方案的安全性来自即便面对大型量子计算机也被认为困难的问题。主要家族包括
- 格基——构建于 LWE / Module-LWE 以及 SIS / NTRU 之上。密钥与签名小，运算快，支撑
ML-KEM、ML-DSA与Falcon。 - 哈希基——安全性仅依赖底层哈希函数，只能用于签名。理论极为保守且研究透彻，但签名体积较大。
- 编码基——基于随机线性码译码的困难性。McEliece 历经四十五年未被攻破，但公钥极大；HQC 与 BIKE 采用结构化码以缩小密钥。
- 多变量——基于求解多变量二次方程组（MQ）。签名紧凑，密钥较大，但历史波折，Rainbow 已于 2022 年被攻破。
- 同源——基于超奇异椭圆曲线之间的同源。密钥极小，但 SIKE 在 2022 年被攻破，目前研究转向 SQIsign 与 CSIDH。
传统上常按五大家族理解 PQC：格基、哈希基、编码基、多变量与同源。近年来 NIST 额外签名征集还纳入了 MPC-in-the-head、对称密码构造等方向，因此“五大家族”更适合作为经典导览框架，而非完整候选分类。
速览对比
| 家族 | 困难问题 | KEM / 签名 | 密钥与签名规模特征 | 成熟度 |
|---|---|---|---|---|
| 格基 | LWE / Module-LWE、SIS、NTRU | 两者皆可 | 小到中等，较为均衡 | 已标准化（FIPS 203/204）；Falcon 待发布 |
| 哈希基 | 哈希函数的原像与抗碰撞性 | 仅签名 | 密钥小，签名大 | 已标准化（FIPS 205、SP 800-208） |
| 编码基 | 随机线性码的伴随式译码 | KEM | 密钥极大（McEliece）或中等（HQC/BIKE） | HQC 于 2025 年入选，标准制定中；McEliece 研究久远 |
| 多变量 | MQ 多变量二次方程 | 主要为签名 | 签名极小，密钥大 | 小众且风险偏高，UOV 进入增补征集 |
| 同源 | 超奇异同源路径搜索 | 曾为 KEM；签名 SQIsign | 密钥极小 | SIKE 已破，SQIsign 进入增补征集 |
密码多样性为何重要
NIST 之所以在多数场景选用格基方案，是因为其在体积与速度上达到最佳平衡。但若整个生态都押注于单一困难问题，风险极高：一旦未来出现针对格的突破，类似 2022 年对 SIKE 与 Rainbow 的攻破，大量已部署系统可能同时失守。
正因如此，NIST 有意标准化了一种非格签名 SLH-DSA（哈希基），并持续推进编码基 KEM HQC 作为格基 ML-KEM 的备份。SIKE 与 Rainbow 的教训具体而深刻：数学优雅紧凑的方案也可能骤然崩塌。稳健的部署应保留多样化的后备选项，并具备快速替换算法的敏捷性。
如何理解各家族
- 通用场景默认选用已标准化的格基方案——小巧、快速、均衡。
- 将哈希基签名作为最保守的长期签名选项保留。
- 关注备份方案——编码基 HQC 提供 KEM 多样性，而多变量与同源方案虽有前景，暂不宜作为承重选择。
格基 →
LWE、Module-LWE、NTRU——PQC 标准的主力。
哈希基 →
仅依赖哈希函数的保守签名方案。
编码基 →
伴随式译码：McEliece、HQC、BIKE。
多变量 →
基于 MQ 的签名与 Rainbow 的警示。
同源 →
极小密钥、SIKE 攻破事件与 SQIsign 研究。
标准与参考
- NIST 后量子密码项目 — 覆盖各 PQC 家族的标准化工作。
- FIPS 203 ML-KEM — 基于格的 KEM 标准。
- FIPS 204 ML-DSA — 基于格的签名标准。
- FIPS 205 SLH-DSA — 基于哈希的签名标准。
- 资源链接 — 完整标准登记册