NIST runs a separate process to collect additional post-quantum digital signature schemes as possible backups to ML-DSA or for special use cases. According to NIST's page, round 3 candidates were announced on 14 May 2026. It does not change what you should deploy today, which is the three finished 2024 standards.
What the process is
In September 2022, NIST called for additional digital signature proposals. The submission period closed on 1 June 2023. Round 1 evaluated 40 algorithms and 14 advanced to round 2. NIST's page says round 2 ended in May 2026 and that round 3 candidates were announced on 14 May 2026. A status report on round 2, NIST IR 8610, is available.
I could not confirm the number of round 3 candidates from the page I fetched, so check NIST's round 3 page for the list.
Why NIST wants more signatures
NIST describes the goal as backups to ML-DSA or schemes for unique use cases. Signature needs vary: some systems care about small signatures, some about fast verification, some about different math assumptions. A broader set gives choices beyond the lattice-based ML-DSA and the hash-based SLH-DSA.
What it means for your roadmap
Nothing here is a reason to wait.
- No candidate in this process is a finished standard. There is nothing to deploy from it today.
- The finished options are ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), plus the stateful LMS and XMSS in SP 800-208.
- Falcon was selected earlier for ongoing standardization, and NIST's project page lists it separately from the additional signature process.
What to do while it runs
- Build agility into signing. Keep algorithm identifiers in formats and verifiers, and avoid assumptions about signature size.
- Test your tooling with the larger signatures of the current standards. If your system cannot handle those, it will not handle candidates either.
- Avoid early adoption of candidate schemes in production. They are in evaluation and can change or be eliminated.
- Track the NIST page once a quarter and note any change in a short decision log.
For standards and procurement teams
Write requirements in terms of NIST standards that exist. Avoid naming a candidate in a contract. If a future standard emerges, an agility plan lets you adopt it without reopening everything.
If someone asks you about a specific candidate from the list, the honest answer is that it is under evaluation and not yet a standard. That answer is correct, short and easy to defend. It also keeps your product pages and questionnaires free of claims about algorithms that may change before any standard exists.
Quick check
Should we wait for round 3 to finish before choosing a signature algorithm?
No. Round 3 candidates are not standards. The finished choices today are in FIPS 204 and FIPS 205, and NIST SP 800-208 for stateful schemes.
Is this the same as the original 2022 selections?
No. It is a separate additional signature process that began with a call in September 2022.
Sources
Last reviewed: 19 October 2026.
