Supported algorithms
June 23, 2026 · View on GitHub
This file documents the algorithms currently integrated into liboqs, with per-variant detail on standardization status, upstream maintenance, OQS support tier, security level, constant-time status, formal verification, and available optimizations.
Definitions
Upstream-maintenance
The Upstream maintenance column records the maintenance level the upstream implementation team has committed to, using one of the labels below. A label is only set when the upstream has confirmed it; otherwise the entry reads TBD.
- Actively maintained. There is a named, responsive upstream contact or team. Upstream commits to investigating security reports in a timely manner and incorporating fixes. Upstream releases updates that OQS can track. Upstream has a public written statement describing this commitment, which OQS links to.
- Best effort. There is a named upstream contact who acknowledges OQS's integration. Upstream will attempt to respond to security reports and incorporate fixes when able, with no commitment on timing or release cadence. Users should not depend on timely upstream fixes.
- No active maintenance. There is no responsive upstream contact, or upstream has publicly stated wind-down or end-of-life. Fixes will not necessarily be incorporated from upstream. Users considering this algorithm should plan accordingly (alternatives, migration, or maintaining their own fork).
- TBD. OQS has not yet obtained a confirmed statement from the upstream. This is not a judgment about the upstream; it means the conversation has not concluded.
OQS support tier
The OQS tier column records OQS's own support commitment for each algorithm. Tiers are self-assigned by the OQS technical governance team via PR review, and are structurally parallel to the platform tiers defined in PLATFORMS.md. Promotion or demotion between tiers is proposed via PR and promotion requires the algorithm to have spent reasonable time at its current tier. Tier assignments are not a recommendation for production use of any algorithm in liboqs; see the project-wide disclaimer in README.md.
- Tier 1 — Core. The highest level of support provided by the project given its limited resources; this should be interpreted within the project's overall limitations. Tier 1 alogrithms must be: upstream marked
Actively maintainedwith a public support statement; covered by the OQS security response process; constant-time tested on all Tier 1 platforms where applicable; built and tested on every Tier 1 platform in CI, every parameter set; at least two OQS committers familiar with the code; has an identified entry inCODEOWNERS. - Tier 2 — Supported. Receives general OQS support, with weaker guarantees than Tier 1. Tier 2 alogrithms must be: upstream at least
Best effort; covered by the OQS security response process on a best-effort basis; built and tested on all Tier 1 platforms in CI; at least one OQS committer familiar with the code; has an identified entry inCODEOWNERS. - Tier 3 — Community. Maintained primarily through community contributions. Tier 3 alogrithms satisfy: upstream status may be any value including
No active maintenance; builds in CI, tests best-effort; no OQS commitment beyond accepting community PRs and refusing to knowingly ship broken code. Users are expected to evaluate suitability themselves.
Key encapsulation mechanisms
| Algorithm family | Standardization | Primary implementation | Upstream maintenance | OQS tier | NIST levels | Constant-time | Formally verified | Optimization targets |
|---|---|---|---|---|---|---|---|---|
| BIKE | Not selected by NIST | awslabs/bike-kem | TBD | Tier 3 (Community) | 1, 3, 5 | ✓ | — | 64-bit little-endian, x86_64 (avx2+avx512+pclmul+sse2) |
| Classic McEliece | Under ISO consideration | PQClean/PQClean@1eacfda | No active maintenance | Tier 3 (Community) | 1, 3, 5 | — | — | portable, x86_64 (avx2+bmi1+popcnt), x86_64 (avx2+popcnt) |
| FrodoKEM | Under ISO consideration | microsoft/PQCrypto-LWEKE@a2f9dec | TBD | Tier 2 (Supported) | 1, 3, 5 | ✓ | — | portable, x86_64 (avx2) |
| HQC | Selected by NIST for upcoming standardization | pqc-hqc/hqc@161cd4f | TBD | Tier 2 (Supported) | 1, 3, 5 | claimed | — | portable |
| Kyber | Selected by NIST as basis for ML-KEM (FIPS 203) | pq-crystals/kyber@441c051 | TBD | Tier 3 (Community) | 1, 3, 5 | ✓ | partial | portable, ARM64_V8, x86_64, x86_64 (avx2+bmi2+popcnt) |
| ML-KEM | Standardized by NIST | pq-code-package/mlkem-native@0ba906c | Actively maintained | Tier 1 (Core) | 1, 3, 5 | ✓ | — | portable, ARM64_V8, CUDA, x86_64 (avx2+bmi2+popcnt) |
| NTRU | Not selected by NIST, under standardization consideration by NTT | PQClean/PQClean@4c9e5a3 | Actively maintained | Tier 3 (Community) | 1, 3, 5 | ✓ | — | portable, x86_64 (avx2+bmi2) |
| NTRU-Prime | Not selected by NIST | openssh/openssh-portable | Actively maintained | Tier 3 (Community) | 2 | ✓ | — | portable |
Signature schemes
| Algorithm family | Standardization | Primary implementation | Upstream maintenance | OQS tier | NIST levels | Constant-time | Formally verified | Optimization targets |
|---|---|---|---|---|---|---|---|---|
| CROSS | Under NIST consideration | CROSS-signature/CROSS-lib-oqs@179d61b | Actively maintained | Tier 3 (Community) | 1, 3, 5 | ✓ | — | portable, x86_64 (avx2) |
| Falcon | Selected by NIST for upcoming standardization | PQClean/PQClean@1eacfda | TBD | Tier 3 (Community) | 1, 5 | ✓ | — | portable, ARM64_V8, x86_64 (avx2) |
| MAYO | Under NIST consideration | PQCMayo/MAYO-C@64e15c6 | Actively maintained | Tier 3 (Community) | 1, 3, 5 | ✓ | — | portable, ARM64_V8, x86_64 (avx2) |
| ML-DSA | Standardized by NIST | pq-code-package/mldsa-native@9b0ee84 | Actively maintained | Tier 2 (Supported) | 2, 3, 5 | ✓ | — | portable, ARM64_V8, x86_64 (avx2+bmi2+popcnt) |
| MQOM | Under NIST consideration | mqom/mqom-v2@ec6b7fa | Actively maintained | Tier 3 (Community) | 1, 3, 5 | ✓ | — | portable, x86_64 (aes+avx2) |
| SLH-DSA | Standardized by NIST | pq-code-package/slhdsa-c@a0fc1ff | Best effort | Tier 3 (Community) | 1, 3, 5 | — | — | portable |
| SNOVA | Under NIST consideration | vacuas/SNOVA@1c3ca6f | Best effort | Tier 3 (Community) | 1, 3, 5 | ✓ | — | portable, ARM64_V8, x86_64 (avx2) |
| UOV | Under NIST consideration | pqov/pqov@33fa527 | Best effort | Tier 3 (Community) | 1, 3, 5 | ✓ | — | portable, ARM64_V8, x86_64 (avx2) |
Stateful signature schemes
| Algorithm family | Standardization | Primary implementation | Upstream maintenance | OQS tier | NIST levels | Constant-time | Formally verified | Optimization targets |
|---|---|---|---|---|---|---|---|---|
| LMS | Standardized by IRTF, approved by NIST | cisco/hash-sigs | Best effort | Tier 2 (Supported) | — | — | — | — |
| XMSS | Standardized by IRTF, approved by NIST | XMSS/xmss-reference | Actively maintained | Tier 2 (Supported) | — | — | — | — |