NIST内部报告 NIST IR 8431

NIST IR 8413-upd1

Status Report on the Third Round of the

NIST Post-Quantum Cryptography

Standardization Process

Gorjan Alagic

Daniel Apon

David Cooper

Quynh Dang

Thinh Dang

Ray Perlner

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8413-upd1

NIST IR 8413-upd1

Status Report on the Third Round of the

NIST Post-Quantum Cryptography

Standardization Process

Gorjan Alagic

Daniel Apon*

Jacob Lichtinger

Computer Security Division

Information Technology Laboratory

Yi-Kai Liu

Applied and Computational Mathematics Division

Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8413-upd1

July 2022

Includes updates as of 09-26-2022; see Appendix E

Certain commercial entities, equipment, or materials may be identified in this document in order to describe

an experimental procedure or concept adequately. Such identification is not intended to imply recommen-

dation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are

necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in

accordance with its assigned statutory responsibilities. The information in this publication, including con-

cepts and methodologies, may be used by federal agencies even before the completion of such companion

NIST IR 8413-upd1 Third Round Status Report

The Information Technology Laboratory (ITL) at the National Institute of Standards and

Technology (NIST) promotes the U.S. economy and public welfare by providing technical

leadership for the Nation’s measurement and standards infrastructure. ITL develops tests,

The National Institute of Standards and Technology is in the process of selecting public-

key cryptographic algorithms through a public, competition-like process. The new public-

key cryptography standards will specify additional digital signature, public-key encryp-

tion, and key-establishment algorithms to augment Federal Information Processing Stan-

dard (FIPS) 186-4, Digital Signature Standard (DSS), as well as NIST Special Publication

(SP) 800-56A Revision 3, Recommendation for Pair-Wise Key-Establishment Schemes Us-

ing Discrete Logarithm Cryptography, and SP 800-56B Revision 2, Recommendation for

Pair-Wise Key Establishment Using Integer Factorization Cryptography. It is intended that

these algorithms will be capable of protecting sensitive information well into the foresee-

able future, including after the advent of quantum computers.

be standardized are CRYSTALS–Dilithium, FALCON, and SPHINCS

. While there are

multiple signature algorithms selected, NIST recommends CRYSTALS–Dilithium as the

primary algorithm to be implemented. In addition, four of the alternate key-establishment

candidate algorithms will advance to a fourth round of evaluation: BIKE, Classic McEliece,

HQC, and SIKE. These candidates are still being considered for future standardization.

NIST will also issue a new Call for Proposals for public-key digital signature algorithms to

augment and diversify its signature portfolio.

cryptography; digital signatures; key-encapsulation mechanism (KEM); key-establishment;

NIST IR 8413-upd1 Third Round Status Report

The NIST Post-Quantum Cryptography Standardization Process webpage is available at

https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-

standardization

NIST is also grateful for the efforts of those in the cryptographic community who pro-

vided security, implementation, and performance analyses of the candidate algorithms dur-

ing the first, second, and third rounds. NIST would not be able to select new post-quantum

public-key algorithms for standardization without the combined efforts of these individuals

and the algorithm submitters.

The authors of this report are also appreciative of the efforts by other members of

NIST’s Post-Quantum Cryptography team who reviewed candidate algorithms, analyses,

and public comments; performed testing; provided technical and administrative support;

and participated in numerous meetings to discuss the selection of the second-round candi-

dates. They are Zuzana Bajcsy, Larry Bassham, Lily Chen, Morris Dworkin, Sara Kerman,

and Andrew Regenscheid. Finally, the authors also would like to thank NIST legal counsel

for helpful discussions.