NIST has two final post-quantum signature standards and nine round-3 candidates
ML-DSA and SLH-DSA are final, FN-DSA has no public draft, and on May 14, 2026 NIST named nine candidates for a third round of additional signatures.
As of November 10, 2026, NIST has two finished post-quantum signature standards, according to shattered.io: ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), both final since August 13, 2024 shattered.io
shattered.ioshattered.ioOpen source ↗. FN-DSA, derived from Falcon, has no public draft. On May 14, 2026, NIST named nine candidates for the third round of its additional-signature process.
Standards and round-3 candidates
ML-DSA derives from CRYSTALS-Dilithium and is treated as the general-purpose choice. SLH-DSA derives from SPHINCS+ and rests on hash functions alone rather than lattice assumptions. FN-DSA descends from Falcon, which NIST selected in 2022. FIPS 206 has not been released, no official draft exists and no publication date is confirmed. One report cited by several vendors expects finalization in late 2026 or early 2027.
The nine round-3 candidates are FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign and UOV. They exist because signatures and keys in ML-DSA and SLH-DSA are large compared with ECDSA and Ed25519. NIST says the goal is to augment FIPS 204, FIPS 205, FIPS 186-5 and SP 800-208, not to replace them. The source has no verified cross-source benchmark numbers for the round-3 candidates, so performance is described only qualitatively.
A naming note: Kyber, Dilithium, SPHINCS+ and Falcon are submission names. The standardized names are ML-KEM, ML-DSA, SLH-DSA and, eventually, FN-DSA shattered.io
shattered.ioshattered.ioOpen source ↗.
NIST IR 8547 roadmap
NIST IR 8547, Transition to Post-Quantum Cryptography Standards, was finalized on October 27, 2026. Reports say it replaced the initial public draft of November 2024. It is a roadmap: it does not revise FIPS 203, 204 or 205 and names no new signature scheme.
Quantum-vulnerable public-key algorithms, including RSA and elliptic-curve signatures, are to be deprecated after 2030 and disallowed under NIST standards and guidelines after 2035. Federal high-value systems face the Executive Order 14412 dates of December 31, 2030 for key establishment and December 31, 2031 for signatures.
In June 2026, NIST published preliminary working drafts for adding post-quantum algorithms, ML-DSA among them, to the Personal Identity Verification standards. HQC, the backup key-encapsulation scheme chosen in March 2025, is not yet a final standard; its target is 2027 shattered.io
shattered.ioshattered.ioOpen source ↗.
For practice, the source suggests ML-DSA as the default. SLH-DSA fits cases that tolerate larger and slower signatures in exchange for fewer mathematical assumptions, such as long-lived firmware roots. Where compact signatures are mandatory, the source advises waiting for FN-DSA and the round-3 field while building crypto-agility.
