NIST Round 4 & Signature Onramp

After standardizing the first PQC algorithms, NIST continued evaluating additional candidates. The fourth round initially involved four KEMs — BIKE, Classic McEliece, HQC, and SIKE — but SIKE dropped out of serious contention after a cryptanalytic break, so the round mainly evaluated BIKE, Classic McEliece, and HQC, and in 2025 selected HQC for standardization; a separate "signature onramp" call sought non-lattice signatures. On 11 March 2025, NIST selected HQC for standardization as an additional KEM alongside ML-KEM, adding diversity in its underlying code-based assumptions — not yet a published FIPS standard.

Why a fourth round?

The headline standards — ML-KEM, ML-DSA, FN-DSA — are all lattice-based. Concentrating the entire ecosystem on one mathematical family is a strategic risk: a single major breakthrough in lattice cryptanalysis could threaten all of them at once. NIST therefore pursued defense in diversity, seeking standardized algorithms built on different hard problems so that a fallback exists.

The Round 4 KEMs

All three are code-based — their security comes from the difficulty of decoding general linear error-correcting codes, a problem studied since the 1970s (the original McEliece scheme dates to 1978). This long pedigree makes them attractive as a hedge against lattice surprises.

HQC: selected as an additional KEM for standardization

On 11 March 2025, NIST announced it would standardize HQC (Hamming Quasi-Cyclic) as an additional KEM alongside ML-KEM — making it the second KEM selected for standardization and, in NIST's own press framing, the fifth PQC algorithm selected by NIST for standardization overall — though it is a KEM, not a signature algorithm. The selection rationale is documented in NIST IR 8545 (Status Report on the Fourth Round, final, Mar 2025). HQC's FIPS number has not yet been officially confirmed by NIST (it is widely expected to be FIPS 207); NIST plans to publish a draft for public comment first, with the final standard expected around 2027. The rationale was explicitly defense in diversity:

• HQC rests on code-based assumptions, mathematically distinct from ML-KEM's Module-LWE.
• It has a clean, well-understood security reduction and reasonable key/ciphertext sizes (larger than ML-KEM, but far smaller than Classic McEliece's public key).
• It gives organizations a standardized non-lattice option for hybrid deployments or as a contingency.

HQC is intended as a backup, not a replacement: ML-KEM remains the recommended primary KEM due to its smaller sizes and better performance. HQC is for those who want lattice-independent assurance.

The signature onramp

Because the signature standards are also lattice-heavy (ML-DSA and FN-DSA), NIST issued a separate call for additional signatures in 2023 — the "signature onramp." Its explicit goal was to attract non-lattice signature schemes and short signatures, broadening the portfolio beyond hash-based (SLH-DSA) and lattice options.

• Many candidates were submitted across diverse families: code-based, multivariate, isogeny-based, symmetric/MPC-in-the-head, and others.
• NIST IR 8528 (final, 2024) reported on the first round of this on-ramp.
• On 24 October 2024, NIST advanced 14 candidates to Round 2: CROSS, FAEST, HAWK, LESS, MAYO, Mirath, MQOM, PERK, QR-UOV, RYDE, SDitH, SNOVA, SQIsign, and UOV. The 6th NIST PQC Standardization Conference was held 24–26 September 2025.
• On 14 May 2026, NIST advanced 9 candidates to Round 3: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, and UOV — of which only HAWK is lattice-based. A roughly two-year evaluation follows, with a 7th NIST PQC Standardization Conference planned for 2027.
• The process is still under evaluation; several early submissions were broken, underscoring the value of public scrutiny.
• Any winners would complement, not replace, ML-DSA and SLH-DSA.

Standards & references

• HQC announced as a fourth-round selection (11 Mar 2025)
• NIST IR 8545 — Status Report on the Fourth Round (final, Mar 2025)
• NIST IR 8528 — Status Report on the First Round of the Additional Signatures On-Ramp (final, 2024)
• Additional Digital Signatures — Round 2 (14 candidates, 24 Oct 2024)
• Nine candidates advance to the third round of additional digital signatures (14 May 2026)
• NIST Post-Quantum Cryptography project (HQC standardization status)