DGA MI, Secure-IC and SERMA Present NYMPHEAS at the Rennes PQC Workshop, 18 November 2026, as NIST's Third Round Drops to Eight Candidates After HAWK Withdraws: TRL 3
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · November 12, 2026.
On Wednesday 18 November 2026, at 17:00 in the Couvent des Jacobins in Rennes, Kirsten Wilk of Secure-IC will present NYMPHEAS, an upstream study of post-quantum digital signatures run jointly by DGA MI, Secure-IC and SERMA. The program of the Rennes PQC Workshop, hosted on the CNRS mathematics pages and updated in early November, describes the study as a comparative overview of the strengths and weaknesses of so-called alternative signature algorithms, schemes whose security foundations differ radically from the lattice-based algorithms already standardized, and lists the five it covers: Dilithium, SDitH, UOV, FAEST and HuFu. The same abstract states that a software implementation was developed independently of the reference implementation and that its characteristics will be presented. DGA MI is the information-mastery center of the Direction générale de l'armement, the French defense procurement agency, so the study is a defense buyer comparing signature families before it writes one into equipment that will stay in service for decades.
The timing matters because the standards picture shifted twice this year. On 14 May 2026 NIST published IR 8610 and advanced nine candidates to a third round of its additional-signature process, and by 13 October 2026 NIST's round-three page showed that one of them, HAWK, had been withdrawn by its submission team. This post reads the development as post-quantum signature selection in the post-quantum cryptography pillar, in the standards and certification sub-branch, defensive in posture and provisionally at the third rung of the readiness ladder, pending verification against the governing rubric, and it sets out what the program establishes, what it leaves open until the talk is given, and what a program office should wait for.
What the Rennes program of 18 and 19 November 2026 establishes: DGA MI, Secure-IC and SERMA compare Dilithium, SDitH, UOV, FAEST and HuFu with their own implementation
The workshop is free with prior registration through the European Cyber Week, which runs from 16 to 19 November 2026 in the same venue. Pantxoa Amorena, head of the cyber division at DGA, opens on the Wednesday morning, followed by Anthony Journault and Nicolas Gurel of ANSSI on the agency's post-quantum transition roadmap and product certification strategy. Pierre Ciadoux, a former NIST associate and one of the sixteen authors of IR 8610, gives the status report on NIST's additional-signature initiative, and Antonin Leroux of DGA MI presents the latest changes to SQIsign. The NYMPHEAS talk closes the first day.
The abstract is short and precise. The study compares five schemes built on four different mathematical foundations. Dilithium is the lattice scheme behind ML-DSA, the signature standard published as FIPS 204, and it serves as the reference point. SDitH is a code-based scheme in the MPC-in-the-head family. UOV is multivariate, built on systems of quadratic equations. FAEST uses a zero-knowledge proof construction with security foundations in both AES and SHA3. HuFu is a lattice scheme that appeared in the first additional-signature round and did not advance to the second. The study team wrote its own software implementation rather than measuring the reference code, which makes the comparison an engineering result rather than a literature review.
Two claims that circulate about the study are absent from the program page. A report on shattered.io, updated on 11 November 2026, states that the study treats Dilithium and FAEST as the two most promising schemes and takes them into FPGA prototyping with side-channel countermeasures. The workshop abstract fetched for this post mentions neither point. Until Secure-IC says it on stage, both stand at the level of a press report, and this post does not build on them.
Where NIST's additional-signature process stands on 12 November 2026: nine candidates advanced in IR 8610 on 14 May, HAWK withdrawn by its own team
NIST's Status Report on the Second Round of the Additional Digital Signature Schemes, IR 8610, final on 14 May 2026, selected nine schemes for a third round on the basis of public feedback and internal review: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign and UOV. Any scheme eventually chosen would sit beside FIPS 204, FIPS 205, FIPS 186-5 and SP 800-208 rather than replace them. The aim of the additional call, since 2022, has been a signature whose security does not rest on structured lattices, adding diversity alongside the hash-based signatures already standardized.
NIST's round-three page, updated 13 October 2026, now shows eight active candidates. Against HAWK it states that the submission team has withdrawn the scheme from the additional digital signatures standardization process. The shattered.io report of 11 November still called the withdrawal an unconfirmed account; NIST's page settles it. The Rennes program adds the technical side: Alice Pellet-Mary of CNRS and the University of Bordeaux speaks on the attacks on HAWK that led to the withdrawal, on how future constructions based on the module lattice isomorphism problem might avoid them, and, in the abstract's own words, on the fact that the attacks have no impact on short-vector problems such as NTRU or module-LWE. That last sentence is the one a buyer should keep. ML-DSA and ML-KEM rest on short-vector problems, and the speaker's abstract places them outside the reach of the HAWK attacks.
Three of the five NYMPHEAS schemes, SDitH, UOV and FAEST, remain on NIST's list. The shattered.io report gives 14 August 2026 as the deadline for updated specifications and relays NIST's indication that the third round should run about two years from May, which places any final selection in 2028 at the earliest.
Quantum pillar: post-quantum cryptography (standards and certification). Use posture: defensive. Technology readiness: assessed at TRL 3 of 9, pending verification against the governing readiness rubric. For the reader this means a working software implementation of five signature schemes exists and its characteristics are scheduled to be presented on 18 November 2026, while the abstract establishes no hardware result or certification profile for the alternative candidates it compares, and NIST has not selected those candidates for standardization.
Why the panel reads post-quantum cryptography (standards and certification), defensive and TRL 3
The pillar is post-quantum cryptography because every scheme in the study is a classical algorithm designed to resist a quantum computer. The sub-branch is standards and certification because the object of the study is algorithm selection: which signature family a French defense buyer could adopt beside ML-DSA, judged against a process in which NIST has yet to choose and ANSSI's certification strategy is on the same program the morning before. The posture is defensive in the sense of the capability map: the value lies in protecting one's own systems and data by migrating signatures before a cryptographically relevant quantum computer arrives.
The readiness placement remains provisional pending verification against the shared ladder. The abstract establishes a software implementation written independently of the reference code, which this post provisionally assesses at TRL 3. It does not establish a bench or laboratory test of a hardware implementation; if Secure-IC presents FPGA measurements on 18 November, a move to TRL 4 would require checking that evidence against the governing rubric. The NIST process itself is a standards instrument and takes no level.
What a signature study by a defense procurement agency would let a force do: hold a second signature family in reserve for equipment that outlives any single mathematical assumption
A signature is the primitive behind firmware updates, boot chains, command authentication and the identity credential a service member carries, and defense equipment keeps those primitives in the field for twenty or thirty years. The United States Department of Defense has already set its clock on the credential side: Quentir's earlier report on the Pentagon's PIV and CAC smart cards moving to post-quantum algorithms by 2030 set out how that migration runs through NIST SP 800-73. NIST has finalized both the lattice-based ML-DSA standard and the stateless hash-based SLH-DSA standard, the latter as FIPS 205 in August 2024. The availability of those standards does not establish which signature every PIV or CAC card must implement; that requirement needs the applicable primary card specification.
The defense-specific capability in NYMPHEAS is therefore crypto-agility by design at the selection stage. A procurement agency that has measured SDitH, UOV and FAEST on its own implementation knows, before any lattice cryptanalysis surprise, which second family fits a given platform's memory, bandwidth and signing budget. Signature size is the sharpest trade-off: code-based and MPC-in-the-head signatures run to several kilobytes, multivariate schemes pair small signatures with large public keys, and FAEST sits between them with security that rests on symmetric cryptographic foundations in AES and SHA3. For a satellite command link or a smart card, those numbers decide whether a scheme is usable at all. The Thursday talks by IDEMIA's Agathe Houzelot on protecting post-quantum code in white-box environments and by CryptoExperts on secure embedded ML-KEM and ML-DSA show that the workshop treats implementation security on the card as a first-order problem, consistent with what Quentir found when IDEMIA and KT put NIST and Korean post-quantum algorithms on one SIM for South Korea's defense pilot.
The beneficiary is the owner of long-lived signed equipment, here a national defense ministry and the primes that supply it. The schemes and the attacks on HAWK are public, and the comparison concerns performance and implementation characteristics on the defender's side.
What stands between the Rennes presentation and a program office relying on it: published measurements, hardware results, an ANSSI certification profile and NIST's final choice
Four items separate the abstract from a requirement. The first is the measurement itself: signature sizes, key sizes, signing and verification times and memory footprints on the independent implementation are what the study exists to produce, and a buyer should wait for the figures rather than the summary. The second is hardware. A software comparison says little about a microcontroller in a card or a flight computer; the FPGA work the press report describes would be the first hardware evidence, and the program page does not yet mention it. The third is certification. ANSSI's product certification strategy opens the same workshop, and its guidance describes product evaluation under PG-083 or ACM and discusses hash-based signatures. Whether applicable certification profiles exist for the particular alternative candidates compared here remains unverified. The fourth is NIST. With a two-year third round, any additional signature standard arrives in 2028 at the earliest, and a program that adopts SDitH, UOV or FAEST before then does so on its own authority and against a specification that can still change.
What the sources support is this. A French defense procurement center, a hardware security firm and a test laboratory have written their own implementation of five post-quantum signature schemes built on four mathematical foundations and are scheduled to present its characteristics in Rennes on 18 November 2026. NIST's third round, opened with nine candidates on 14 May 2026, now holds eight after HAWK's team withdrew it, and the Rennes speaker places the attacks behind that withdrawal outside the problems that protect ML-DSA and ML-KEM. For a defense reader the study is an open comparison of alternative post-quantum signatures made from a buyer's seat, and the implementation characteristics Secure-IC is scheduled to present on the Wednesday evening are the evidence to wait for.
Sources
Primary source: the program of the PQC Workshop 2026, Rennes, 18 and 19 November 2026, hosted on the CNRS mathematics pages, including the abstract of "Presentation of the NYMPHEAS upstream study" by Kirsten Wilk (Secure-IC) for the study conducted jointly by DGA MI, Secure-IC and SERMA, and the abstract of "Cryptanalysis of the signature scheme Hawk" by Alice Pellet-Mary (CNRS, Université de Bordeaux). Other material: NIST IR 8610, 14 May 2026; the NIST round-three additional signatures page, updated 13 October 2026; the shattered.io report by Elena Marchetti, updated 11 November 2026; the European Cyber Week 2026 registration page. The capability reading, the posture argument, the readiness placement and the buyer items are Quentir analysis.