QuantumSuperposition: Classical computing encodes information in bits, each representing either 0 or 1. In contrast, quantum computing encodes information in quantum bits (qubits). A qubit is a two-level quantum system with two orthogonal basis states, typically denoted as | 0 〉 and | 1 〉 . Unlike classical bits, a qubit can exist in the states |0⟩, | 1 〉 , or any linear combination of them. This property, known as superposition, is represented as shown [5]:

here, α and β are complex probability amplitudes corresponding to each basis state, and they satisfy the normalization condition | α | 2 + | β | 2 = 1

QuantumEntanglement is a phenomenon in which the quantum states of two or more objects become correlated, such that the state of one object influences the state of the others, even when separated by large distances. According to quantum theory, particles can exist in multiple states simultaneously and may become inextricably linked, or “entangled”, despite physical separation. Quantum entanglement is mathematically described using the formalism of quantum states in a Hilbert space, which encompasses all possible states of a quantum system. Entangled states are represented using notation that explicitly shows the relationship between the quantum states of the particles involved. The creation of n-qubit entangled states can be achieved using a Hadamard gate and (n − 1) Controlled-NOT (C-NOT) gates. One of the most famous entangled states is the Bell state:

Quantum repeaters cannot be constructed because quantum particle states cannot be duplicated. However, particles at either end of a network can be connected via a chain of linked particles, creating a repeater effect that forms the foundation of a quantum network. This connection enables the development of advanced protocols like quantum teleportation.

QuantumTeleportation: This technique transfers quantum information between two locations via a classical link, meaning the information cannot be transmitted faster than the speed of light. Despite its name, quantum teleportation does not involve the physical movement of information; rather, it involves transferring the state of quantum information via entanglement.

HeisenbergUncertaintyPrinciple: Introduced in 1927 by German physicist Werner Heisenberg, this principle highlights the limitations in precisely knowing certain pairs of physical quantities, such as position and momentum. It establishes a fundamental relationship, stating that both variables cannot be known with absolute precision simultaneously. Mathematically, it sets a lower bound on the uncertainties of complementary variables.

PhotonPolarizationPrinciple: Polarization is a phenomenon associated with the wave nature of electromagnetic radiation, arising from interactions between electric and magnetic fields. Light waves can be classified as unpolarized, with vibrations occurring in multiple planes, or polarized, with vibrations limited to a single plane. Polarization describes the orientation of electric field vectors perpendicular to the direction of wave propagation. A single photon’s polarization represents a two-state quantum system, or qubit, with horizontal and vertical polarizations as the logical states. Other polarization states are combinations of these two. The typical polarization-state pairs are shown in Table 1 below.

Table 1. Representation of light polarization as a two-level system or qubit.

TheNo-cloningtheorem is a principle in quantum mechanics stating that identical copies of arbitrary unknown quantum states cannot be made. Introduced by Wootters, Zurek, and Dieks in 1982, it has significant implications for quantum computing. While orthogonal states like {|0⟩, |1⟩} can be copied as with classical bits, replicating an arbitrary single-qubit state is impossible.

A significant challenge in classical cryptography is safe key generation and exchange, particularly in unsecured environments. When two parties communicate, they must share information over public channels, exposing them to potential attacks. A key advancement in quantum cryptography is Quantum Key Distribution (QKD) [6].

QKD uses quantum mechanics to generate a secret key over a quantum channel, ensuring security based on the laws of physics. The randomness of quantum states and measurements facilitates key generation, and the no-cloning theorem guarantees uniqueness. The Uncertainty Principle further protects QKD against interception attempts [7]. QKD protocols can be categorized into [8]:

ContinuousVariable(CV)QKD: Information is encoded through position and momentum quadratures of a quantized electromagnetic field in an infinite-dimensional Hilbert space, exemplified by the Gaussian modulation protocol.DiscreteVariable(DV)QKD: This approach uses finite-dimensional discrete variables like phase and polarization, including protocols such as BB84, B92, and SARG04.DistributedPhase Reference(DPR)QKD: In DPR protocols, a single photon is not required for encoding; in fact, Key information is encoded using the phase difference or arrival times of photons, employing weak coherent pulses. DPR protocols include Differential Phase Shift (DPS) QKD and Coherent One-Way (COW) QKD.

Based on the architecture of protocols, DV-QKD protocols can be regrouped into two categories:

Prepare-and-measureprotocols: These measure unknown quantum states, helping detect eavesdropping and assess intercepted data.Entanglement-basedprotocols: These involve linked quantum states where the measurement of one affects the other, alerting involved parties if an eavesdropper interferes with a trusted node. Figure 1 represents the classification of QKD protocols.

Figure 1. Classification of QKD protocols.

Each QKD protocol has its own advantages and disadvantages, so the best choice depends on the specific use case. A QKD protocol works in two main phases. First is the quantum transmission phase, where the sender and receiver exchange and measure quantum states. Next is the post-processing phase, where the bit strings from the quantum phase are turned into a pair of secure keys. For QKD to work, it requires two channels: a quantum channel and a classical channel, used to exchange messages. In the quantum channel, a beam of photons is sent, with each photon encoded by its polarization [7]. Figure 2 shows a basic QKD process.

QKD provides information-theoretic security; however, it depends on authenticated classical channels during post-processing. Without authentication, these channels are vulnerable to man-in-the-middle attacks. Conventional approaches require communicating parties to pre-share symmetric keys through physical meetings, which is not feasible for multi-user QKD networks. A comprehensive security analysis of QKD must explicitly consider authentication overhead; discrepancies between theoretical proofs and practical implementation security, including side-channel countermeasures; endpoint security assumptions about device trust and key storage; and the potential for hybrid approaches that combine QKD with post-quantum cryptographic authentication.

QKD is already practical and can be used with today’s technology, even without quantum computers. However, QKD only handles key distribution and does not replace the encryption systems we rely on to keep our communication secure.

Figure 2. Basic key distribution protocol process [Generated by AI].

The National Institute of Standards and Technology (NIST) launched a process to select quantum-resistant public-key cryptographic algorithms, aiming to establish robust standards to counter quantum-computer attacks. This initiative focuses on algorithms for digital signatures, public-key encryption, and key establishment, building on NIST’s previous standards like DES, AES, and SHA.

In February 2016, NIST called for global contributions to develop post-quantum cryptography standards. By November 2017, 82 draft algorithms had been submitted, and 69 were accepted for the initial standardization phase. After thorough reviews, 26 candidates advanced in January 2019: 17 key establishment mechanisms and 9 digital signatures, chosen for their potential based on analysis and community feedback [10].

The second round included further evaluation, resulting in seven finalists and eight alternates selected in July 2020. NIST planned to standardize a select few finalists and alternates after a fourth round. This third round lasted about 18 months, during which NIST conducted detailed assessments of the theoretical and empirical security evidence, along with performance benchmarking.

In July 2022, NIST identified four final algorithms: Crystals-Kyber for key establishment and Crystals-Dilithium, Falcon, and Sphincs+ for digital signatures, with Crystals-Dilithium recommended as the primary choice. The process also set four alternate KEM candidates—BIKE, Classic McEliece, HQC, and SIKE—for further evaluation [10]. The fourth round began at the end of 2022 and focused on security validation. During this phase, SIKE was deemed insecure, and feedback collected from the cryptographic community proved insightful.

In August 2024, NIST completed the PQC standardization process by issuing three Federal Information Processing Standards (FIPS) specifying particular algorithms. The approved standards are the Module Lattice-Based Key Encapsulation Mechanism (ML-KEM) [11] from CRYSTALS-Kyber for key encapsulation, the Module Lattice-Based Digital Signature Algorithm (ML-DSA) [12] from CRYSTALS-Dilithium for digital signatures, and the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) [13] from SPHINCS+ for hash-based digital signatures. These algorithms are authorized for use in both federal and commercial environments. A fourth algorithm, the FFNTT-based NTRU Lattice Digital Signature Algorithm (FN-DSA), related to Falcon, remains in draft status with final approval anticipated in late 2026 or early 2027.

By March 2025, NIST announced HQC for standardization, aiming to finalize it in 2027 [14]. The PQC standardization process can be summarized in Figure 3.

Figure 3. PQC standardization process of NIST.

Cryptographic systems are categorized by their security foundations. PQC relies on complex mathematical challenges to ensure resilience against classical and quantum threats. Noteworthy families include lattice-based, isogeny-based, multivariate, code-based, and hash-based cryptography [15].

This review examines cryptographic families evaluated by the NIST Post-Quantum Cryptography Standardization Project. The comparison is based on criteria including the underlying mathematical problems and their anticipated resistance to quantum attacks; key, signature, and ciphertext sizes; and computational efficiency for key generation, encryption, signing, decryption, and verification. Additional considerations include memory requirements, practical deployment, and the strength of security proofs. To clarify algorithm status, three categories are defined: 1) officially standardized schemes with finalized NIST FIPS designations which are suitable for practical implementation; 2) selected but not yet finalized candidates which remain in draft status; and 3) obsolete or compromised schemes such as Rainbow and SIKE, which were eliminated following successful cryptanalytic attacks. Figure 4 shows the cryptosystem families and the algorithms used.

3.2.1. Lattice-Based Cryptography Methods

Lattice-based cryptography relies on complex mathematical structures called lattices to develop encryption methods resilient to quantum attacks. These lattices consist of regularly spaced points in a multi-dimensional space. A vector indicates a specific point, with the origin represented by all zeros. Vectors can be categorized as “far” (larger norm) or “short” (smaller norm) based on their distance from the origin. A basis, a select group of vectors, can represent all points in the lattice by ensuring no two points lie along the same line from the origin [1].

Figure 4. Post-quantum cryptography methods.

Definition1. Asetofvectors { v 1 , v 2 , ⋯ , v m } ∈ ℝ n islinearlyindependentiftheequation

acceptsonlythetrivialsolution α 1 = α 2 = ⋯ = α m = 0 .

Definition2.Givennlinearlyindependentvectors { b 1 , b 1 , ⋯ , b m } ∈ ℝ n , thelatticegeneratedbythemisdefinedastheset

Thesetofvectors { b 1 , b 1 , ⋯ , b m } iscalledthebasisofthelatticeL.

LetBdenotethen × mmatrixwithcolumns b 1 , b 1 , ⋯ , b m , thenalatticecanbewrittenas

MatrixBiscalledabasismatrix. AbasisforLisanysetoflinearlyindependentvectorsthatspansL.

Definition3.TherankofalatticeLisdefinedasthenumberofelementsinanybasisofL, whichequalsthedimensionofthevectorsubspacespannedbyL.

Wecallmtherankofthelattice, andnthedimension. If n = m ,thelatticeLiscalledafull-ranklattice.

Lattice L may be generated by various bases, and this concept is generalized using an unimodular matrix.

Definition4.Amatrix U ∈ ℤ n × n iscalledunimodularifdet U = ± 1 .

Definition5.LetLbealatticewithdimensionnand B = { b 1 , b 2 , ⋯ , b m } abasisofthelattice. WedefinethefundamentalparallelepipedofLtobetheset

(6)

Definition6. Let L = L ( B ) be a lattice of rank n, and let B be a basis of L. ThedeterminantofL, denoted by det(L), isthen-dimensionalvolumeof

. The determinant can be written as

Definition7. For any lattice L = L(B), we define the minimum distance of L as the smallest distance between any two lattice points:

Lattice problems are particularly vital because they resist efficient solutions, even on quantum computers. This ensures secure protocols against future quantum attacks [16].

A. ShortestVectorProblem (SVP)

The primary computational challenge in lattice theory is the Shortest Vector Problem (SVP). Because a lattice L is discrete, it has a nonzero element v ∈ L of minimum length under, say, the Euclidean norm. The fundamental parameter of a lattice is the length of its shortest nonzero vector, denoted as λ 1 .

Definition8. (ShortestVectorProblem). Givenabasis B = { b 1 , b 2 , ⋯ , b m } oflatticeL(B), findthenonzerovector, i.e., find v ∈ L ( B ) forwhich ‖ v ‖ = λ 1 ( L ( B ) ) .

Figure 5 shows the vector closest to the origin.

Figure 5. The shortest vector problem [17].

B. ClosestVectorProblem (CVP)

CVP is a computational problem in lattices that is closely related to the Shortest Vector Problem (SVP). In the CVP, a lattice L and a target point x are given, and the objective is to identify the lattice point closest to x . This problem is highly challenging because it is NP-hard. Moreover, it is considered more difficult than the SVP, which seeks the shortest non-zero lattice vector. Let L denote a lattice and let t be a fixed point in ℝ n . The distance is defined as follows:

Definition9. (ClosestVectorProblem). Givenabasis B = { b 1 , b 2 , ⋯ , b m } ofalatticeL(B) andatargetvectort, whichmaynotbelongtothelattice, findthelatticepoint v ∈ L ( B ) closesttot.

Therefore, the requested nonzero vector v ∈ L ( B ) is the one for which ‖ t − v ‖ is minimal, i.e., ‖ v ‖ = d ( t , L ) , as represented in Figure 6.

Figure 6. The closest vector problem [17].

C. ShortestIndependentVectorsProblem (SIVP)

The primary objective is to identify a new basis that generates the same lattice while minimizing the length of the longest vector. Figure 7 illustrates this problem.

Figure 7. Shortest Independent Vector Problem (SIVP) [17].

Definition10.ShortestIndependentVectorsProblem (SIVP). Givenabasis B = { b 1 , b 2 , ⋯ , b m } ofalattice L ( B ) , findnlinearlyindependentvectors { v 1 , v 2 , ⋯ , v n } thatbelongtothelatticesuchthat ‖ v i ‖ ≤ λ n for 1 ≤ i ≤ n .

D. LearningwithError (LWE) Problem

LWE has emerged as a fundamental element in efficient lattice-based protocols and is recognized as a significant milestone in the theoretical basis of PQC. This cryptosystem is believed to be as hard as the most difficult lattice problems. It generalizes the Learning Parity with Noise (LPN) problem to larger moduli. Specifically, the LWE problem considers a secret vector s = ( s 1 , s 2 , ⋯ , s n ) ∈ ℤ n with integer coefficients and m linear equations, such that:

By adding noise to linear equations, the LWE problem complicates tasks like Gaussian elimination, rendering the resulting equations ineffective in providing useful information. Error accumulation makes it difficult to arrive at the correct outcome.

Definition11. (LWE) Letn, qbepositiveintegers, andxbeaprobabilitydistributionon ℤ andsbeasecretvectorin ℤ q n . Wedenoteby L s , x theprobabilitydistributionon ℤ q n × ℤ q obtainedbychoosing a ∈ ℤ q n uniformlyatrandom, choosing e ∈ ℤ . Accordingtox, andconsideringitin ℤ q andreturning

Decision-LWE is the problem of deciding whether pairs ( a , b ) ∈ ℤ q n × ℤ q are sampled according to L s , x or the uniform distribution on ℤ q n × ℤ q .

Search-LWE is the problem of recovering s from ( a , b ) = ( a , 〈 a , s 〉 + e ) ∈ ℤ q n × ℤ q sampled according to L s , x .

The solution is asked to lie in a subset S ⊂ ℤ q m . Where S can be a subset such that S = { 0 , 1 } or, in general, the set of all solutions S = [ − B , ⋯ , B ] m , and each coordinate takes an absolute value bounded by some number B ≪ q / 2 . This is the Short Integer Solution (SIS) problem. The LWE problem is regarded as an analog of the SIS problem. To further improve efficiency while preserving security, the M-LWE problem generalizes LWE by introducing a ring structure. For a polynomial ring R = ℤ [ X ] / ( X n + 1 ) and modulus q, M-LWE is defined over the module R q k as follows [18]:

with A ∈ R q k × k , s ∈ R q k , e ← x k distinguishing this distribution from uniform.

This refinement underpins NIST’s standardized schemes: the Module-Lattice Key Encapsulation Mechanism (ML-KEM) and the Module-Lattice Digital Signature Algorithm (ML-DSA). These constructions balance rigorous theoretical guarantees with computational efficiency, rendering them suitable for practical deployment and ensuring they inherit the robust hardness assumptions of classical lattice problems [18].

E. ShortIntegerSolution (SIS) Problem

The Short Integer Solution (SIS) problem requires identifying a nonzero short vector in a specific class of random lattices, known as random q-ary lattices.

Definition12. (TheShortIntegerSolutionproblem) parameterizedbypositiveintegersn, m, andq, denotedby SIS_n,m,q,β. Givenmuniformlyrandomvector a i ∈ ℤ q n formingthecolumnofamatrix A ∈ ℤ q n × m , findanonzerointegervector z ∈ ℤ m ofnorm ‖ z ‖ ≤ β , suchthat:

In terms of a lattice problem, the SIS problem states that, given a lattice generated by A, find a nonzero integer vector z ∈ ℤ n such that:

Lattice-based cryptography is a promising approach to PQC for its security, flexibility, and resistance to quantum attacks. A distinguishing characteristic of lattice-based cryptography is its reliance on worst-case security, whereas most other cryptosystems are based on average-case security. Several lattice-based algorithms are leading candidates, each offering distinct advantages in terms of security, computational efficiency, and practical usability.

CRYSTAL-KYBER is part of the Cryptographic Suite for Algebraic Lattices (CRYSTAL) family of primitives. In late 2022, the National Institute of Standards and Technology (NIST) standardized the CRYSTALS-Kyber algorithm, citing its strong security, efficient hardware and software implementations across multiple platforms, and compatibility with most existing internet protocols and cryptographic applications [15]. KYBER has been proposed as a public-key algorithm offering security levels comparable to Advanced Encryption Standard (AES) schemes. It functions as a Key Encapsulation Mechanism (KEM) and is based on the computational hardness of the Module-Learning-With-Errors (MLWE) problem. A KEM consists of three algorithms: Key Generation, Encapsulation, and Decapsulation. In a standard key-establishment procedure, the recipient generates a public-private key pair. The sender then uses the recipient’s public key to perform the encapsulation operation, which produces both a ciphertext and a shared secret. The recipient applies the corresponding private key to decapsulate the ciphertext and independently derive the same shared secret. This shared secret may be used directly or processed through a key-derivation function to generate a symmetric session key, enabling efficient authenticated encryption and secure communication. Consequently, Kyber is not primarily intended for encrypting application data. Its main function is to provide a quantum-resistant way to establish cryptographic keying material, after which symmetric-key cryptography can efficiently secure the exchanged data.

SABER is a finalist in the Public-Key Encryption (PKE) category for PQC, with security based on the hardness of the MLWR problem. Developed by Banerjee, Peikert, and Rosen at EUROCRYPT 2012, SABER achieves Indistinguishability under Chosen-Plaintext Attack (IND-CPA). The scheme employs a hierarchical structure of algorithms. First, it constructs a CPA-secure public-key encryption scheme based on the MLWR problem. Subsequently, a post-quantum adaptation of the Fujisaki-Okamoto transform constructs a Chosen-Ciphertext Attack (CCA)-secure KEM scheme [19].

CRYSTALS-Dilithium is a digital signature scheme that relies on the complexity of the Module Short Integer Solution (MSIS) and MLWE problems. As part of the CRYSTALS suite, NIST selected it as a finalist in the post-quantum cryptography standardization process in July 2020. The scheme operates within a polynomial ring defined by two integers, n and q, with a matrix of polynomials used in its operations. Security levels can be adjusted by varying the matrix dimensions, enabling optimization across different levels. Dilithium offers four parameter sets: weak, medium, recommended, and very high, with the recommended level featuring 2.7 KB signatures and 1.5 KB public keys.

NTRU (N-th degree Truncated polynomial Ring Unit), introduced in 1998 by Hoffstein, Pipher, and Silverman, represents the first practical public-key encryption scheme utilizing lattices over polynomial rings. It supports both encryption (NTRUencrypt) and digital signatures (NTRUSign). Its security hinges on the difficult shortest vector problem in lattice reduction, for which no known polynomial-time solution exists. In 2009, the IEEE approved NTRU for standardization. Although NIST did not select NTRU as one of the top four quantum-resistant algorithms, it offers advantages over competitors such as KYBER and Saber, including a compact ciphertext and potentially faster encryption and decryption [20].

Falcon (Fast-Fourier Lattice-based Compact Signatures over NTRU) is a cryptographic signature algorithm that was submitted to the NIST Post-Quantum Cryptography Project on November 30, 2017. It is based on NTRU and employs lattice-based techniques to provide a robust solution for digital signing in the context of quantum computing. The algorithm utilizes a technique based on the work of Gentry, Peikert, and Vaikuntanathan, combined with Fast Fourier sampling, to generate signatures. Falcon’s core elements are polynomials with integer coefficients, usually of degree that is a power of two, such as 512 or 1024. It performs calculations in the field of Q [ x ] / ( ϕ ) , operating under a monic polynomial of degree represented as ϕ , which takes the form ϕ = x n + 1 . Falcon’s structure includes three key processes: key generation, signature generation, and verification [21].

In post-quantum cryptography, schemes such as CRYSTALS-Kyber, NTRU, and SABER address key encapsulation and secure key exchange, while Falcon and CRYSTALS-Dilithium serve as digital signature methods. NIST selected CRYSTALS-Kyber as the standard KEM for its security and efficiency. Dilithium offers effective signature creation with simple implementation, whereas Falcon yields smaller signature sizes but incurs greater complexity. NTRU is one of the earliest lattice-based systems, while SABER offers an efficient alternative based on Module-LWR that avoids the need for the NTT.

3.2.2. Code-Based Cryptography Methods

Code-based cryptography leverages the intractability of decoding general linear codes, a challenge that quantum computers also find insurmountable. This approach is based on the difficulty of decoding error-correcting codes known as Goppa codes, which remain unbroken and are linear codes with fast-decoding algorithms. They are used in a wide range of applications, including hard drives, satellite communication, and fault-tolerant quantum computation.

Definition13.Let g ( z ) = g 0 + g 1 z + g 2 z 2 + ... + g t z t ∈ F q m [ z ] , andlet L = { α 1 , α 2 , ⋯ , α n } ⊆ F q m suchthat g ( α i ) ≠ 0 , all α i ∈ L . Then, thecodedefinedby

is called Goppa code with parameters g ( z ) and L; denoted by Γ ( L , g ( z ) ) .

The general problems in coding theory that underlie the security of code-based cryptosystems are listed below.

Problem1.GeneralDecoding. Given G ∈ F q k × n ofrank k , t ∈ [ 0 , n ] , y ∈ F q n where y = c + e with c = m G forsome m ∈ F q k and | e | = t , find e .

Problem2.SyndromeDecoding. Given H ∈ F q ( n − k ) × n ofrank n − k , t ∈ [ 0 , n ] , s ∈ F q n − k where H e T = s T with | e | = t , find e .

The problem remains exponentially hard in the general case, even after extensive research in coding theory, information theory, and computational complexity. This persistent difficulty supports strong confidence in the long-term security of code-based cryptography, which is underpinned by robust mathematical foundations and an extensive history of cryptanalysis. Code-based cryptography offers security guarantees established through decades of theoretical and practical analysis. Notably, the original McEliece cryptosystem has withstood attacks for nearly five decades of intensive cryptanalytic scrutiny [18].

ClassicMcEliece is a code-based KEM that utilizes binary Goppa codes within the Niederreiter variant of the McEliece cryptosystem. These codes, combined with established cryptographic techniques, achieve IND-CCA2 security and resist chosen-ciphertext attacks. The original McEliece cryptosystem was developed to guarantee One-Wayness under Chosen-Plaintext Attacks (OW-CPA), ensuring that if an adversary randomly selects a codeword, it cannot efficiently recover it from the ciphertext and public key. McEliece’s security level has remained stable over time. The cryptosystem is based on three core algorithms: a probabilistic key-generation algorithm that outputs a public-private key pair, a probabilistic encryption algorithm, and a deterministic decryption algorithm. In a McEliece deployment, all users employ the same security parameters: n, t, andk. Therecommended parameter values are n = 1024, t = 38, andk = 644 [22].

HQC (Hamming Quasi-Cyclic) is a KEM that employs quasi-cyclic codes without embedding a trapdoor in the code. This approach leverages the distinctive properties of quasi-cyclic codes and provides a direct security reduction to decoding random linear codes. Unlike similar candidates, the security proof for HQC relies solely on assumptions related to the decisional Quasi-Cyclic Syndrome Decoding (QCSD) problem [23]. HQC’s IND-CPA security relies on the computational hardness of QCSD and the associated parity issue. Applying the Fujisaki-Okamoto (FO) transformation to a CPA-secure Public-Key Encryption (PKE) scheme enables HQC to achieve IND-CCA2 KEM security. Although the quasi-cyclic structure of HQC yields relatively small public keys and ciphertexts, they remain larger than those of structured lattice-based KEMs. NIST has determined that HQC complements ML-KEM effectively, as it is based on a distinct security foundation while maintaining sufficient performance for general applications. NIST further asserts that the HQC submission satisfies the requirements for a low Decryption Failure Rate (DFR), thereby ensuring IND-CCA2 security [14].

BIKE (Bit-Flipping Key Encapsulation) is a KEM based on binary linear Quasi-Cyclic Moderate-Density Parity-Check (QC-MDPC) codes, a class of error-correcting codes that enable efficient encryption, decryption, and key exchange. Although the BIKE cryptosystem was originally developed for ephemeral key use, it is now claimed to support static-key applications as well.

Definition14.Aquasi-cycliccodeisalinearcodeforwhichcyclicallyshiftingacodewordafixednumbern₀ ≠ 0 ofpositionseithertotherightortotheleftresultsinanothercodeword. Forn₀ = 1, aquasi-cycliccodeisacycliccode. Theintegern₀iscalledtheshiftingconstraint.

Several standard methods represent a quasi-cyclic parity-check code. For a code with a shifting constraint n 0 and positive integers c and t , where c < t , let H i ∈ F 2 c × n 0 for i ∈ [ t ] . The nullspace of is then a quasi-cyclic parity-check code [24].

The secret key comprises a parity-check matrix H r × 2 r , for a Quasi-Cyclic Moderate-Density Parity-Check (QC-MDPC) code, where r denotes a prime number. Each row of matrix H possesses a specified weight. The secret key is denoted by (h₀, h₁), and the public key is derived from it. During encryption, the message is interpreted as an error vector e of weight t, and the ciphertext is computed accordingly. Decryption requires multiplying the ciphertext by h₀ to obtain the syndrome, which is subsequently decoded using a Black-Grey-Flip (BGF) decoder to recover either the error vector or the original message [9]. The security of the BIKE algorithm relies on the computational intractability of decoding randomly generated error-correcting codes without knowledge of the private key, which poses significant challenges for attackers, including those equipped with quantum computers, attempting to recover the shared key.

3.2.3. Hash-Based Cryptography Methods

Hash functions are mathematical tools that convert input data of any size into a fixed-length output, called a hash value. A key characteristic of these functions is that they are one-way, making it nearly impossible to retrieve the original data from the hash. This feature is crucial for maintaining data integrity and identifying any alterations. Additionally, hash functions exhibit collision resistance, meaning it’s difficult to find two distinct inputs that yield the same hash, which is vital for cryptographic security [22].

In the late 1970s, hash-based signature schemes emerged, initially as one-time signature systems developed by Lamport and later extended by Ralph Merkle. He created the MerKel signature schemes and proposed the MerKel tree structure. The security of these systems is straightforward to assess and relies on the hash function used. However, users must keep track of how many signatures have been created with a specific key. Over the past 40 years, advancements have enhanced the efficiency and theoretical foundations of hash-based signatures, culminating in XMSS, which is nearing standardization as the first signature scheme designed to withstand quantum threats. These schemes combine one-time signatures with a Merkle tree structure to sign messages effectively [25]. Hash-based signature schemes integrate a One-Time Signature scheme (OTS) with a Merkle tree structure. Because each OTS key securely signs only one message, multiple keys are organized into a Merkle tree to enable signing multiple messages.

SPHINCS, developed by a team of researchers, is a hash-based signature scheme that does not rely on stateful components, making it the first to propose parameters against quantum attacks. It builds on components of XMSS but uses larger keys and signatures, thereby removing the need for state [26]. The scheme incorporates elements from HORST and WOTS+⁺ (Winternitz OTS), which traditionally require pre-generated keys to calculate the Merkle root, limiting key management. In contrast, SPHINCS can handle many more keys through two methods: a hyper-tree for authentication and a random key-path addressing scheme.

SPHINCS+ improves this framework with better speed, security, and smaller signatures. While it retains similar principles, it differs by using FORS for signing, implementing a publicly verified leaf-index selection, and introducing tweakable hash functions, thereby streamlining the security analysis of hash-based signatures [22].

3.2.4. Isogeny-Based Cryptography Methods

Isogeny-based cryptography combines elliptic curves and isogenies, showing promise as a secure cryptographic approach. An elliptic curve consists of points that satisfy a specific equation over a finite field and form a group under operations such as point addition. Elliptic curves, which are projective curves of genus 1 with a specified base point, are fundamental in cryptography, especially in Elliptic Curve Cryptography (ECC), as shown in Figure 8 [27].

Figure 8. Elliptic curve cryptography lines [27].

Isogenies are algebraic maps between elliptic curves over finite fields that serve as group homomorphisms, as illustrated in Figure 9. These maps define relationships between curves, and their degrees quantify the size of the isogeny, a property particularly important for separable isogenies [27].

Figure 9. Isogeny [26].

Supersingular elliptic curve isogeny cryptography leverages these properties to implement key-exchange protocols like Diffie-Hellman, offering a quantum-resistant alternative with smaller key sizes than many other post-quantum cryptographic systems. The primary schemes in this domain are Supersingular Isogeny Diffie-Hellman (SIDH) and its commutative variant (CSIDH), while Supersingular Isogeny Key Encapsulation (SIKE) has been submitted to the NIST Post-Quantum Cryptography Competition [10].

SIKE is a key encapsulation method chosen in the third round of NIST’s post-quantum standardization process. It builds on the SIDH key exchange protocol from 2011, utilizing arithmetic on elliptic curves and computing isogenies between them. The security of both SIDH and SIKE depends on the difficulty of identifying a specific isogeny between two curves, which is distinct from the discrete logarithm problem on a single curve [28].

One key advantage of these methods is their small public keys, making them among the most compact quantum-resistant algorithms. However, their relatively slow performance has limited their effectiveness as practical post-quantum candidates.

3.2.5. Multivariate Cryptography Methods

Multivariate cryptography uses asymmetric encryption based on multivariate polynomials over finite fields. It’s commonly used to create digital signatures and is known for producing the shortest signatures among Post-Quantum Cryptography (PQC) methods. The security of this approach hinges on the complexity of solving nonlinear systems of equations, particularly multivariate quadratic polynomial systems [25]. There are primarily two categories of multivariate digital signature schemes. The first includes BigField schemes like HFEv and the NIST candidate GeMSS. The second category comprises SingleField schemes, including UOV and Rainbow [29]. While some multivariate encryption and authentication schemes have proven weak, a few signature schemes have withstood cryptanalysis. Notably, UOV (Unbalanced Oil and Vinegar) and SFLASH v2 are two resilient schemes that have demonstrated effective implementation and were recognized in 2002 by the European project NESSIE as viable digital signature algorithms.

Definition15. (Multivariatequadraticmaps) The central object in Multivariate Quadratic cryptography is the multivariate quadratic map. A multivariate quadratic map

with m components and n variables is a sequence

of m multivariate quadratic polynomials in n variables x = ( x 1 , ⋯ , x n ) , with coefficients in a finite field F q . To evaluate the map

at a value a ∈ F q n , simply evaluate each of its component polynomials in a to get a vector

of m output elements; denote this by

[30].

Rainbow, created in 2004 by Jintai Ding and Dieter Schmidt, is a digital signature scheme derived from Jacques Patarin’s Oil-Vinegar (UOV) model. It features a trapdoor function represented by a multivariate quadratic map with several layers of nested subspaces. The version presented in the NIST PQC project features a 2-layer variant with specific dimensions and equations connecting inputs and outputs. Although Rainbow offers rapid signature generation and verification, its key generation is slower [29].

In 2022, a key-recovery attack exploited SIKE’s torsion-point information, enabling full key recovery within hours on a single core and prompting NIST to withdraw the scheme from consideration. Similarly, Ward Beullens applied a rectangular MinRank attack to Rainbow, rapidly recovering the private key and resulting in its removal from the standardization process. These incidents highlight significant risks in post-quantum cryptanalysis, demonstrating that structured algebraic problems may harbor vulnerabilities and rendering such methods unsuitable for practical deployment, despite prior assumptions of quantum resistance.