# NIST Additional Signature On-Ramp: Round 3 Candidates and Status **Source**: https://quantumsequrity.com/blog/nist-signature-onramp **Category**: Future Research --- [← Back to Blog](../../blog) Future Research # NIST Additional Signature On-Ramp: Round 3 Candidates and Status 7 min read NIST's post-quantum signature standards today are ML-DSA (FIPS 204) and SLH-DSA (FIPS 205). A third, FN-DSA (Falcon), is planned as FIPS 206, which NIST had not published as of October 2026. To widen the choice of signatures, NIST runs a separate process often called the signature "on-ramp": the Additional Digital Signature Schemes for the NIST PQC Standardization Process. On 14 May 2026 NIST moved nine candidates into the third round and published its second-round report, NIST IR 8610. This post sets out what the on-ramp is for, the timeline so far, which schemes remain, and what it means for deployments today. It reflects the process as of October 2026. ## Why NIST Wants More Signatures ML-DSA and FN-DSA are both lattice schemes: ML-DSA uses module lattices and FN-DSA uses NTRU lattices (see [Lattice-Based Cryptography Explained](lattice-based-cryptography-explained)). A major advance against structured lattices would affect both. SLH-DSA is hash-based and very conservative, but its signatures are large, from 7,856 bytes (SLH-DSA-128s) to 49,856 bytes (SLH-DSA-256f). In NIST IR 8610's words, NIST sought "additional general-purpose signature schemes based on a non-lattice security assumption as well as signature schemes optimized for short signatures and fast verification." Any scheme eventually selected would augment FIPS 204, FIPS 205, FIPS 186-5 and SP 800-208, not replace them. ## Timeline So Far The timeline below follows Table 1 of NIST IR 8610 and the report's closing section. | Date | Event | |------|-------| | July 2022 | NIST announces a forthcoming call for additional digital signatures | | September 2022 | Call for Proposals published | | June 2023 | Submission deadline; NIST receives 50 packages | | July 2023 | NIST accepts 40 first-round candidates | | April 2024 | Fifth NIST PQC Standardization Conference | | 24 October 2024 | 14 second-round candidates announced; NIST IR 8528 (first-round report) | | January 2025 | Deadline for updated second-round packages | | 24 to 26 September 2025 | Sixth NIST PQC Standardization Conference | | 14 May 2026 | Nine third-round candidates announced; NIST IR 8610 (second-round report) | | 14 August 2026 | Deadline for third-round submission updates | | First half of 2027 | Next NIST PQC Standardization Conference (planned) | ## The 14 Second-Round Candidates NIST IR 8610 groups the second-round candidates as follows: - **Code-based**: CROSS, LESS - **Lattice-based**: HAWK - **Isogeny-based**: SQIsign - **MPC-in-the-head**: FAEST, Mirath (a merger of the first-round MIRA and MiRitH), MQOM, PERK, RYDE, SDitH - **Multivariate**: UOV, MAYO, QR-UOV, SNOVA ## The Nine Third-Round Candidates **Multivariate: UOV, MAYO, QR-UOV, SNOVA.** UOV, MAYO and SNOVA were attacked during the second round, but NIST kept all four multivariate schemes because each still has unbroken parameter sets and distinct benefits. MAYO and SNOVA could serve as general-purpose signatures because of their small public keys. UOV is closest to the original Oil and Vinegar design studied for decades, though its expanded public keys exceed 200 kilobytes, so NIST is mainly interested in it for certain applications. QR-UOV resists the wedge attack and has moderately smaller public keys than UOV. NIST says it anticipates a longer timeline for these schemes and is unlikely to standardize them without a further round of evaluation. **MPC-in-the-head: FAEST, MQOM, SDitH.** Among the six MPC-in-the-head candidates, NIST had the most confidence in the security of FAEST, which relies only on AES, and found that MQOM had the strongest performance numbers. SDitH adds diversity: its security rests on the well-studied syndrome decoding problem for random linear codes. **Isogeny-based: SQIsign.** SQIsign has the smallest combined public key and signature size of the second-round candidates. Its signing procedure is mathematically intricate, while verification is simpler and much faster. It avoids the auxiliary torsion-point information that the 2022 attacks on SIDH and SIKE exploited. **Lattice-based: HAWK.** NIST selected HAWK because it offers smaller signatures than Falcon and does not need floating-point arithmetic. HAWK's submission team has since withdrawn it, and NIST's third-round page marks it as withdrawn, which leaves eight candidates under evaluation. ## The Five That Did Not Advance NIST IR 8610 states that candidates not selected for the third round are no longer under consideration for standardization. Its reasons, in short: - **CROSS**: small public keys but very large signatures, an underlying problem studied for a much shorter time than SLH-DSA's, and a second-round attack that forced new parameters. - **LESS**: small signatures but very large public keys, much slower than CROSS, and attacked during the second round. - **Mirath**: NIST chose a smaller set of MPC-in-the-head schemes with more established security or a better performance profile, despite Mirath's large speed improvements. - **PERK**: a slight signature-size advantage over FAEST, offset by much slower computation. NIST noted this was not a lack of confidence in the Permuted Kernel Problem. - **RYDE**: similar structure and trade-offs to the other MPC-in-the-head schemes, so NIST narrowed the field to the candidates with the strongest combination of performance and community analysis. ## What Happens Next Third-round submitters could adjust their specifications and code until 14 August 2026, and NIST expects such changes to be relatively minor. Over the following months NIST asked the community for security analysis, optimized implementations, results on constrained platforms and hardware performance data. It plans another PQC Standardization Conference in the first half of 2027. NIST has not announced when it will select schemes for standardization. ## What This Means Today None of the on-ramp candidates is a NIST standard, so none belongs in production systems that need standardized cryptography. For signatures today, the standardized options are ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), plus the stateful hash-based LMS and XMSS (SP 800-208) for uses such as firmware signing. The on-ramp is worth tracking if you need much smaller signatures or a non-lattice assumption later, and its candidates are suitable for testing and research. ## What QNSQY Offers QNSQY signs with ML-DSA-44 on Free, and with ML-DSA-44, -65 and -87 and SLH-DSA on Pro and Business, each available on its own or combined with Ed25519 (see [Hybrid Encryption](hybrid-encryption)). Business also offers FN-DSA, labelled pre-standard because FIPS 206 is not published, and LMS. QNSQY does not ship any on-ramp candidate, because none of them is a NIST standard. ## Frequently Asked Questions ### When will the on-ramp signatures be standardized? NIST has not announced a date. The third round began on 14 May 2026, submission updates were due on 14 August 2026, and NIST plans its next PQC Standardization Conference in the first half of 2027. For the multivariate candidates, NIST said it is unlikely to standardize them without a further round of evaluation. ### How many candidates are left? Nine candidates entered the third round: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign and UOV. HAWK has since been withdrawn by its submission team, which leaves eight. ### Why does NIST want more signatures when ML-DSA exists? For diversity. ML-DSA and the planned FN-DSA both rely on structured lattices, and SLH-DSA, the non-lattice option, has large signatures. NIST is looking for general-purpose schemes based on other assumptions, and for schemes with short signatures and fast verification. ### Are the on-ramp candidates safe to use today? Not in production. They are still under evaluation, and several candidates were attacked during the second round. Use them for testing and research, and use ML-DSA, SLH-DSA, LMS or XMSS where standardized signatures are required. ### What happened to the candidates that were dropped? CROSS, LESS, Mirath, PERK and RYDE were not selected for the third round, and NIST IR 8610 states that they are no longer under consideration for standardization. ### Does QNSQY support any on-ramp candidate? No. QNSQY offers ML-DSA, SLH-DSA, LMS and the pre-standard FN-DSA, and does not ship any of the on-ramp candidates. ## Sources 1. NIST. "Status Report on the Second Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process." NIST IR 8610, May 2026. https://csrc.nist.gov/pubs/ir/8610/final 2. NIST. "Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process." NIST IR 8528, October 2024. https://csrc.nist.gov/pubs/ir/8528/final 3. NIST. "Round 3 Additional Signatures." https://csrc.nist.gov/Projects/pqc-dig-sig/round-3-additional-signatures 4. NIST. "Post-Quantum Cryptography: Digital Signature Schemes." https://csrc.nist.gov/projects/pqc-dig-sig 5. NIST. "Nine Candidates Advance to the Third Round of the Additional Digital Signatures for the PQC Standardization Process." 14 May 2026. https://www.nist.gov/news-events/news/2026/05/nine-candidates-advance-third-round-additional-digital-signatures-pqc ## Related Articles - [Multivariate Cryptography Explained](multivariate-cryptography-explained) - [Isogeny Crypto Post-SIKE](isogeny-crypto-post-sike) - [FN-DSA-512 Deep Dive](fn-dsa-512-deep-dive) - [ML-DSA vs SLH-DSA](mldsa-vs-slhdsa) - [NIST PQC Standards Timeline](nist-pqc-standards-timeline) - [NIST FIPS Guide for Post-Quantum Standards](nist-fips-guide) - [What Is Post-Quantum Cryptography?](what-is-post-quantum-cryptography) --- ### Protect Your Data Before Q-Day Arrives QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats. [Try QNSQY](../../pricing)