A lattice is the set of integer combinations of basis vectors; finding short or close vectors in high dimensions is believed hard even for quantum computers. LWE asks to recover a secret s from many samples (a, a·s + e) with small noise e; Module-LWE and Module-SIS, used by ML-KEM and ML-DSA, work over polynomial rings (degree 256, modulus 3,329 for ML-KEM and 8,380,417 for ML-DSA), which keeps keys compact and lets the number-theoretic transform make arithmetic fast. FN-DSA uses NTRU lattices.
Security estimates rely on the cost of lattice-reduction algorithms such as BKZ, with margins chosen for NIST's security categories. Lattice schemes have larger keys and outputs than elliptic curves (about 1–5 KB) but are fast; most practical attacks so far have targeted implementations (timing leaks, fault attacks) rather than the mathematics.