NIST leaned on it heavily. As of August 2026, three of the five algorithms NIST has selected for standardization are lattice-based, covering key establishment and digital signatures. The organization expects its first standards to become the foundation of most deployments.
This piece explains what a lattice is and why these problems resist quantum computers, then shows where the schemes already appear in the migration.
What a lattice is
A lattice is an infinite grid of points, spaced by a repeating pattern and stretched into hundreds of dimensions. The same lattice can be written with many different bases, some far less useful than others, and the hard problems are geometric.
Two famous ones are the shortest vector problem, which asks for the shortest nonzero vector, and the closest vector problem, which asks for the lattice point nearest a target. In high dimensions, and for general instances, finding a short enough vector or a close enough point can turn computationally prohibitive. How hard it gets depends on the problem and its parameters, so dimension is only one factor.
In low dimensions, the problems look easy. A person can eyeball the nearest grid point on a sheet of paper. Push the dimension into the hundreds or thousands, and the best known general methods can turn exorbitantly expensive. Their cost depends on the exact problem and parameters, and usually grows exponentially in the lattice dimension.
Decades of work on lattice reduction have produced major improvements without yielding an efficient general solution at cryptographic parameters. This track record is a major part of why cryptographers trust it.
Lattice cryptography rests on problems like finding the point nearest a target. Simple in two dimensions, prohibitively hard in hundreds.
Learning with errors
Most modern lattice schemes don't ask you to solve a raw geometry problem. They use a friendlier-looking version called learning with errors, or LWE. Here, you start with a system of linear equations, then add a small random error to each one. Without the errors, a student could solve the system in minutes with basic algebra. With them, recovering the secret becomes a lattice problem in disguise, and the difficulty returns with it.
The idea came from Oded Regev in 2005, and it carried a rare guarantee. Regev gave a quantum reduction from specified approximate worst-case lattice problems, including GapSVP and SIVP, to average-case LWE under particular parameter conditions. In plain terms, an efficient solver for those LWE instances would also yield a quantum algorithm for the associated worst-case problems, in an unusual and valuable connection.
Its practical weight still depends on the reduction's parameters and tightness, so it isn't proof that a deployed LWE scheme is secure.
Basic LWE has strong theoretical foundations but carries substantial key and ciphertext costs. Practical schemes add algebraic structure to cut that burden. ML-KEM and ML-DSA use module lattices, which balance efficiency against the amount of added structure, and Falcon takes a different route through NTRU lattices. These designs are a lot smaller and faster than basic LWE, and each leans on more specialized assumptions than generic LWE. This extra structure is also the part cryptographers watch most closely, since structure is what an attacker would try to exploit.
Learning with errors: clean linear equations are easy to solve, but adding a small error to each turns recovering the secret into a hard lattice problem.
Why quantum computers don't break lattice-based cryptography
Shor's algorithm is catastrophic because factoring and discrete logs reduce to a period-finding problem a quantum computer can crack. No Shor-style quantum reduction is known for the lattice problems these schemes use.
The leading generic attacks on LWE-based schemes reduce the problem to lattice reduction and then use techniques such as sieving or enumeration. Quantum versions improve some exponents or search steps, at times with severe memory requirements, but stay exponential at the standardized parameter sizes. These attacks are nothing like Shor's polynomial-time break.
No polynomial-time classical or quantum algorithm is known for the relevant LWE, Module-LWE, Module-SIS, or NTRU problems at cryptographic parameters, and we cover the wider shift in Post-Quantum Cryptography Explained.
Where it's already standardized
NIST finished its first post-quantum standards in August 2024, and lattices dominate.
ML-KEM, the key-establishment standard drawn from Kyber, is built on module-LWE. ML-DSA, the main signature standard drawn from Dilithium, is built with module-lattice problems, including Module-LWE and Module-SIS-type assumptions. Falcon, which NIST plans to standardize as FN-DSA, is an NTRU-lattice signature with unusually compact signatures. The other finalized standard is SLH-DSA, derived from SPHINCS+, which uses hash-based signatures and serves as a conservative backup.
Size is a big reason lattices took so many slots. Falcon signatures run about 666 or 1,280 bytes at its two levels, and ML-DSA signatures run from 2,420 to 4,627 bytes, against SLH-DSA's 7,856 to 49,856 bytes. Compact signatures like these cut bandwidth and storage next to the hash-based option. Hash-based schemes hold one edge: very small public keys, but their signatures are much larger, and signing can be slower.
NIST also selected the code-based HQC in 2025 as a backup key method, still moving through standardization.
Strengths and open questions
Beyond size, lattices are versatile. The same math powers key exchange and signatures, and it powers the fully homomorphic encryption that lets a server compute on data it can't read. Craig Gentry presented the first such scheme in 2009, built on ideal lattices, though that first construction was far from practical. The field has grown from there.
The open questions concern structure and implementation. Module and NTRU lattices add structure that a future attacker might exploit. Module-LWE and Module-SIS do carry their own worst-case reductions, but only to problems on module lattices, which doesn't prove they're as hard as arbitrary lattices or that the chosen parameters are unbreakable.
Implementation is a separate hazard.
Falcon's signing needs delicate floating-point Gaussian sampling that can leak through side channels if it's done carelessly, and demonstrated power-analysis attacks have hit vulnerable implementations. Those demands helped push NIST toward ML-DSA, as its primary general-use signature, since it’s simpler to protect. The standardized schemes remain unbroken, and their structure and implementation still demand scrutiny.
Lattices and crypto
Where crypto is concerned, lattice signatures sit behind many of the leading quantum-safe proposals. Plenty of post-quantum blockchain plans look at ML-DSA or Falcon, helped by NIST's selection of both. Others weigh alternatives like hash-based signatures or proof-based authorization. The signatures that authorize spending today, ECDSA and Schnorr, are vulnerable to Shor's algorithm. Lattice schemes are leading replacement candidates, though the field is still settling.
That's the ground qLABS builds on. Because migrating a base chain takes years, a smart contract can add a post-quantum check in the meantime and guard a contract's assets as long as the ordinary key can't remove it, though it doesn't make the base chain quantum-safe.
qLABS applies this model in qVAULT, a non-custodial vault the company describes as using Falcon-based authorization. Falcon is the lattice signature NIST plans to standardize as FN-DSA. The vault currently lists qONE and HYPE as supported assets. qLABS develops and promotes qVAULT and qONE. It publishes the L1 Quantum Vulnerability Index, which gives it a commercial and reputational interest in the claims presented here. So, weigh everything you read with that in mind and don’t treat any of it as financial advice.
FAQ
What is lattice-based cryptography?
It's a family of encryption and signature schemes whose security rests on hard problems in high-dimensional lattices, like finding the closest point in a vast grid. No known quantum algorithm solves those problems efficiently at cryptographic sizes, which is why it's the leading form of post-quantum cryptography.
Is lattice-based cryptography quantum safe?
As far as anyone knows, yes. The best quantum attacks on lattice problems give only a small speedup over classical ones, nothing like the total break Shor's algorithm delivers against RSA and elliptic curves. No efficient quantum attack on the core lattice problems is known after more than 20 years of study, though that's current knowledge, not proof.
What is learning with errors?
Learning with errors, or LWE, is a workhorse problem behind many modern lattice schemes. It asks you to recover a secret from a set of linear equations that each carry a small random error. The errors turn easy algebra into a hard lattice problem, and under specified parameters, its security has reductions from approximate worst-case lattice problems.
Which NIST algorithms are lattice-based?
Three of NIST's selected algorithms are lattice-based. ML-KEM handles key establishment, and ML-DSA and Falcon handle signatures, though Falcon is still on its way to becoming FN-DSA. The other selected schemes are the hash-based SLH-DSA and the code-based HQC. ML-KEM, ML-DSA, and SLH-DSA are already finalized, and Falcon and HQC are still in progress.
Can lattice-based cryptography be broken?
No efficient attack on the standardized schemes is known, classical or quantum. The risks people watch are narrower: whether the extra structure in the efficient variants hides a weakness, and whether implementations leak through side channels. Conservative parameters and continued cryptanalysis reduce the mathematical risk, and constant-time design and masking reduce implementation risk. None of that rules out a future breakthrough or an implementation flaw, which is one of the reasons NIST is also standardizing schemes from other families.
qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.
