Post-Quantum Signature Schemes
Comparing NIST on-ramp candidates and standardized schemes. Click column headers to sort. Use the filters to narrow down by category, security level, or size constraints.
Data reflects the latest known specifications for each scheme, last updated 2026-09-08. Consult the individual scheme websites for the most current information.
Filters ▼
pk size vs. sig size (log–log scale)
Shape = family · tap point for details
Scroll to zoom · drag to pan
Performance note: Cycle counts are from our own benchmarks on a Intel(R) Xeon(R) Platinum 8488C —
see the environment details below.
| Assumption | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| ECDSA | Pre-Quantum | Classic | P-256 | N/A | 65 | 72 | 137 | 22.3 µs | 63.7 µs | Elliptic Curves |
| ECDSA | Pre-Quantum | Classic | P-384 | N/A | 97 | 104 | 201 | 161.7 µs | 366.1 µs | Elliptic Curves |
| ECDSA | Pre-Quantum | Classic | P-521 | N/A | 133 | 139 | 272 | 205.1 µs | 391.1 µs | Elliptic Curves |
| EdDSA | Pre-Quantum | Classic | Ed25519 | N/A | 32 | 64 | 96 | 33.7 µs | 88.8 µs | Elliptic Curves |
| EdDSA | Pre-Quantum | Classic | Ed448 | N/A | 57 | 114 | 171 | 137.3 µs | 174.3 µs | Elliptic Curves |
| FAEST | Symmetric | On-ramp | 128s | 1 | 32 | 4,066 | 4,098 | 3.00 ms | 2.62 ms | AES |
| FAEST | Symmetric | On-ramp | 128f | 1 | 32 | 5,170 | 5,202 | 423.0 µs | 309.4 µs | AES |
| FAEST | Symmetric | On-ramp | EM-128s | 1 | 32 | 3,466 | 3,498 | 1.75 ms | 1.52 ms | AES |
| FAEST | Symmetric | On-ramp | EM-128f | 1 | 32 | 4,170 | 4,202 | 351.3 µs | 235.1 µs | AES |
| FAEST | Symmetric | On-ramp | 192s | 3 | 48 | 9,410 | 9,458 | 12.06 ms | 9.90 ms | AES |
| FAEST | Symmetric | On-ramp | 192f | 3 | 48 | 11,738 | 11,786 | 1.82 ms | 1.41 ms | AES |
| FAEST | Symmetric | On-ramp | EM-192s | 3 | 48 | 7,874 | 7,922 | 8.49 ms | 7.97 ms | AES |
| FAEST | Symmetric | On-ramp | EM-192f | 3 | 48 | 9,818 | 9,866 | 1.19 ms | 891.3 µs | AES |
| FAEST | Symmetric | On-ramp | 256s | 5 | 48 | 16,626 | 16,674 | 17.20 ms | 16.72 ms | AES |
| FAEST | Symmetric | On-ramp | 256f | 5 | 48 | 20,856 | 20,904 | 2.55 ms | 2.02 ms | AES |
| FAEST | Symmetric | On-ramp | EM-256s | 5 | 64 | 14,554 | 14,618 | 11.76 ms | 11.02 ms | AES |
| FAEST | Symmetric | On-ramp | EM-256f | 5 | 64 | 18,084 | 18,148 | 2.16 ms | 1.64 ms | AES |
| Falcon | Lattices | Std pending | 1024 | 5 | 1,793 | 1,280 | 3,073 | 319.1 µs | 33.4 µs | NTRU-SIS |
| Falcon | Lattices | Std pending | 512 | 1 | 897 | 666 | 1,563 | 162.8 µs | 19.5 µs | NTRU-SIS |
| HAWK | Lattices | On-ramp | 1024 | 5 | 2,440 | 1,221 | 3,661 | 50.8 µs | 51.4 µs | Lattice Isomorphism |
| HAWK | Lattices | On-ramp | 512 | 1 | 1,024 | 555 | 1,579 | 21.8 µs | 25.0 µs | Lattice Isomorphism |
| MAYO | Multivariate | On-ramp | five | 5 | 5,554 | 964 | 6,518 | 215.4 µs | 91.4 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | three | 3 | 2,986 | 681 | 3,667 | 94.4 µs | 41.3 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | two | 1 | 2,928 | 239 | 3,167 | 26.4 µs | 11.3 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | one | 1 | 1,456 | 464 | 1,920 | 47.2 µs | 20.9 µs | Multivariate Quadratic |
| ML-DSA | Lattices | FIPS | ML-DSA-87 | 5 | 2,592 | 4,627 | 7,219 | 96.7 µs | 54.1 µs | MLWE/MSIS |
| ML-DSA | Lattices | FIPS | ML-DSA-65 | 3 | 1,952 | 3,309 | 5,261 | 76.1 µs | 34.7 µs | MLWE/MSIS |
| ML-DSA | Lattices | FIPS | ML-DSA-44 | 2 | 1,312 | 2,420 | 3,732 | 46.7 µs | 21.6 µs | MLWE/MSIS |
| MQOM | MPCitH | On-ramp | L1-gf2-shorter-ct | 1 | 52 | 2,492 | 2,544 | 2.52 ms | 1.80 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf2-shorter-ot | 1 | 52 | 2,492 | 2,544 | 3.64 ms | 3.51 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-short-ct | 1 | 64 | 2,932 | 2,996 | 807.1 µs | 921.5 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-short-ot | 1 | 64 | 2,932 | 2,996 | 905.9 µs | 899.3 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-fast-ct | 1 | 64 | 3,316 | 3,380 | 272.9 µs | 293.4 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-fast-ot | 1 | 64 | 3,316 | 3,380 | 307.5 µs | 289.9 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf2-shorter-ct | 3 | 78 | 5,932 | 6,010 | 7.27 ms | 6.97 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf2-shorter-ot | 3 | 78 | 5,890 | 5,968 | 9.74 ms | 8.86 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-short-ct | 3 | 96 | 6,556 | 6,652 | 3.75 ms | 4.08 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-short-ot | 3 | 96 | 6,556 | 6,652 | 5.45 ms | 4.92 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-fast-ct | 3 | 96 | 7,564 | 7,660 | 1.13 ms | 1.19 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-fast-ot | 3 | 96 | 7,660 | 7,756 | 1.32 ms | 1.27 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf2-shorter-ct | 5 | 104 | 10,836 | 10,940 | 10.99 ms | 12.28 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf2-shorter-ot | 5 | 104 | 10,804 | 10,908 | 13.71 ms | 13.25 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-short-ct | 5 | 128 | 12,100 | 12,228 | 4.66 ms | 5.57 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-short-ot | 5 | 128 | 11,716 | 11,844 | 6.26 ms | 6.05 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-fast-ct | 5 | 128 | 13,540 | 13,668 | 1.89 ms | 2.00 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-fast-ot | 5 | 128 | 13,380 | 13,508 | 2.38 ms | 2.05 ms | Multivariate Quadratic |
| QR-UOV | Multivariate | On-ramp | I-(127 156 54 3) | 1 | 24,256 | 200 | 24,456 | 142.2 µs | 80.6 µs | UOV |
| QR-UOV | Multivariate | On-ramp | I-(127 540 60 10) | 1 | 11,041 | 541 | 11,582 | 725.7 µs | 230.8 µs | UOV |
| QR-UOV | Multivariate | On-ramp | III-(127 228 78 3) | 3 | 71,884 | 292 | 72,176 | 393.4 µs | 232.5 µs | UOV |
| QR-UOV | Multivariate | On-ramp | III-(127 820 90 10) | 3 | 35,454 | 821 | 36,275 | 2.43 ms | 721.9 µs | UOV |
| QR-UOV | Multivariate | On-ramp | V-(127 306 105 3) | 5 | 173,660 | 392 | 174,052 | 963.9 µs | 540.9 µs | UOV |
| QR-UOV | Multivariate | On-ramp | V-(127 1040 110 10) | 5 | 63,541 | 1,039 | 64,580 | 4.39 ms | 1.42 ms | UOV |
| RSA | Pre-Quantum | Classic | 2048 | N/A | 272 | 256 | 528 | 524.9 µs | 20.2 µs | Factoring |
| RSA | Pre-Quantum | Classic | 3072 | N/A | 422 | 384 | 806 | 1.18 ms | 39.5 µs | Factoring |
| RSA | Pre-Quantum | Classic | 4096 | N/A | 550 | 512 | 1,062 | 2.16 ms | 64.3 µs | Factoring |
| SDitH | MPCitH | On-ramp | SDitH2-L1-gf2-short | 1 | 70 | 3,721 | 3,791 | 2.46 ms | 2.22 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L1-gf2-fast | 1 | 70 | 4,914 | 4,984 | 531.5 µs | 450.2 µs | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L3-gf2-short | 3 | 98 | 8,484 | 8,582 | 11.26 ms | 11.07 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L3-gf2-fast | 3 | 98 | 10,852 | 10,950 | 2.53 ms | 2.38 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L5-gf2-short | 5 | 132 | 15,147 | 15,279 | 17.48 ms | 17.27 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L5-gf2-fast | 5 | 132 | 19,144 | 19,276 | 3.81 ms | 3.58 ms | Synd. Dec. |
| SLH-DSA | Symmetric | FIPS | SHAKE-192s | 3 | 48 | 16,224 | 16,272 | 992.53 ms | 819.9 µs | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-256s | 5 | 64 | 29,792 | 29,856 | 912.60 ms | 1.21 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-128s | 1 | 32 | 7,856 | 7,888 | 556.73 ms | 557.0 µs | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-256f | 5 | 64 | 49,856 | 49,920 | 93.23 ms | 2.43 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-192f | 3 | 48 | 35,664 | 35,712 | 44.85 ms | 2.36 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-128f | 1 | 32 | 17,088 | 17,120 | 27.12 ms | 1.61 ms | Hash-based |
| SNOVA | Multivariate | On-ramp | SNOVA_I_K | 1 | 376 | 528 | 904 | 164.9 µs | 62.3 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_I_B | 1 | 656 | 388 | 1,044 | 176.2 µs | 56.9 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_I_S | 1 | 1,016 | 272 | 1,288 | 130.3 µs | 50.8 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_III_K | 3 | 912 | 688 | 1,600 | 357.7 µs | 128.8 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_III_B | 3 | 1,416 | 532 | 1,948 | 388.3 µs | 129.3 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_III_S | 3 | 2,032 | 456 | 2,488 | 453.6 µs | 133.5 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_V_K | 5 | 1,216 | 896 | 2,112 | 946.2 µs | 276.5 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_V_B | 5 | 1,891 | 691 | 2,582 | 935.5 µs | 211.3 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_V_S | 5 | 2,716 | 591 | 3,307 | 999.4 µs | 209.3 µs | Non-comm. Ring UOV |
| SQIsign | Isogenies | On-ramp | V | 5 | 169 | 406 | 575 | 209.68 ms | 20.42 ms | Isogenies |
| SQIsign | Isogenies | On-ramp | III | 3 | 129 | 306 | 435 | 99.28 ms | 8.37 ms | Isogenies |
| SQIsign | Isogenies | On-ramp | I | 1 | 83 | 200 | 283 | 25.96 ms | 3.22 ms | Isogenies |
| UOV | Multivariate | On-ramp | V-pkc | 5 | 446,992 | 275 | 447,267 | 120.5 µs | 411.1 µs | UOV |
| UOV | Multivariate | On-ramp | V-classic | 5 | 3,232,320 | 275 | 3,232,595 | 126.8 µs | 115.5 µs | UOV |
| UOV | Multivariate | On-ramp | III-pkc | 3 | 189,232 | 209 | 189,441 | 46.7 µs | 167.4 µs | UOV |
| UOV | Multivariate | On-ramp | III-classic | 3 | 1,347,912 | 209 | 1,348,121 | 44.3 µs | 60.4 µs | UOV |
| UOV | Multivariate | On-ramp | Is-pkc | 1 | 66,576 | 96 | 66,672 | 16.9 µs | 47.6 µs | UOV |
| UOV | Multivariate | On-ramp | Is-classic | 1 | 412,160 | 96 | 412,256 | 17.8 µs | 11.7 µs | UOV |
| UOV | Multivariate | On-ramp | Ip-pkc | 1 | 46,591 | 135 | 46,726 | 15.4 µs | 43.8 µs | UOV |
| UOV | Multivariate | On-ramp | Ip-classic | 1 | 321,300 | 135 | 321,435 | 14.9 µs | 17.6 µs | UOV |
87 parameter sets
Legend: 💣 pre-quantum (classical security only) · 🧨 broken · ⚠️ security warning · ℹ️ note · value estimated from cycle counts · tap icons for details
Benchmark environment
Date 22 September 2026
CPU Intel(R) Xeon(R) Platinum 8488C — 16 cores,
2 threads/core,
MHz max, governor: unknown, turbo: unknown
OS Ubuntu 26.04.1 LTS (kernel 7.0.0-1012-aws)
Compiler cc (Ubuntu 15.2.0-16ubuntu1) 15.2.0
OpenSSL OpenSSL 3.5.5 27 Jan 2026 (Library: OpenSSL 3.5.5 27 Jan 2026)
Method Median over 1000 iterations (fewer for slow schemes). Cycle counter: rdpmc CPU_CYCLES (real core cycles, user-space). Wall clock: clock_gettime(CLOCK_MONOTONIC). Benchmark thread pinned to one core.
Implementation sources ▸
- faest faest-sign/faest-arch-opt@1d833097
- fndsa pornin/c-fn-dsa@33026d4d
- hawk hawk-sign/dev@1b9fef52
- mayo PQCMayo/MAYO-C@74de637a
- mldsa pq-crystals/dilithium@6e00625c
- mqom mqom/mqom-v3@d9c64e38
- qruov qruov/round3@3d84d0f6
- sdith sdith/sdith@fff41ae5
- sdith2 sdith/sdith@ce7adf06
- slhdsa pq-code-package/slhdsa-c@fac08b7d
- snova PQCLAB-SNOVA/SNOVA@9b29c1e3
- sqisign SQISign/the-sqisign@6d017708
- uov pqov/pqov@fac2ec1f
Benchmark data licensed under CC-BY-4.0 — Thom Wiggers / PQShield