Advanced Graph
← BackCustomise axes to compare schemes on any combination of size and performance dimensions.
Filters ▼
pk size vs. sig size (log–log scale)
X axis
Y axis
Shape = family · tap point for details
Scroll to zoom · drag to pan
| Assumption | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| ECDSA | Pre-Quantum | Classic | P-256 | N/A | 65 | 72 | 137 | 22.3 µs | 63.7 µs | Elliptic Curves |
| ECDSA | Pre-Quantum | Classic | P-384 | N/A | 97 | 104 | 201 | 161.7 µs | 366.1 µs | Elliptic Curves |
| ECDSA | Pre-Quantum | Classic | P-521 | N/A | 133 | 139 | 272 | 205.1 µs | 391.1 µs | Elliptic Curves |
| EdDSA | Pre-Quantum | Classic | Ed25519 | N/A | 32 | 64 | 96 | 33.7 µs | 88.8 µs | Elliptic Curves |
| EdDSA | Pre-Quantum | Classic | Ed448 | N/A | 57 | 114 | 171 | 137.3 µs | 174.3 µs | Elliptic Curves |
| FAEST | Symmetric | On-ramp | 128s | 1 | 32 | 4,066 | 4,098 | 3.00 ms | 2.62 ms | AES |
| FAEST | Symmetric | On-ramp | 128f | 1 | 32 | 5,170 | 5,202 | 423.0 µs | 309.4 µs | AES |
| FAEST | Symmetric | On-ramp | EM-128s | 1 | 32 | 3,466 | 3,498 | 1.75 ms | 1.52 ms | AES |
| FAEST | Symmetric | On-ramp | EM-128f | 1 | 32 | 4,170 | 4,202 | 351.3 µs | 235.1 µs | AES |
| FAEST | Symmetric | On-ramp | 192s | 3 | 48 | 9,410 | 9,458 | 12.06 ms | 9.90 ms | AES |
| FAEST | Symmetric | On-ramp | 192f | 3 | 48 | 11,738 | 11,786 | 1.82 ms | 1.41 ms | AES |
| FAEST | Symmetric | On-ramp | EM-192s | 3 | 48 | 7,874 | 7,922 | 8.49 ms | 7.97 ms | AES |
| FAEST | Symmetric | On-ramp | EM-192f | 3 | 48 | 9,818 | 9,866 | 1.19 ms | 891.3 µs | AES |
| FAEST | Symmetric | On-ramp | 256s | 5 | 48 | 16,626 | 16,674 | 17.20 ms | 16.72 ms | AES |
| FAEST | Symmetric | On-ramp | 256f | 5 | 48 | 20,856 | 20,904 | 2.55 ms | 2.02 ms | AES |
| FAEST | Symmetric | On-ramp | EM-256s | 5 | 64 | 14,554 | 14,618 | 11.76 ms | 11.02 ms | AES |
| FAEST | Symmetric | On-ramp | EM-256f | 5 | 64 | 18,084 | 18,148 | 2.16 ms | 1.64 ms | AES |
| Falcon | Lattices | Std pending | 1024 | 5 | 1,793 | 1,280 | 3,073 | 319.1 µs | 33.4 µs | NTRU-SIS |
| Falcon | Lattices | Std pending | 512 | 1 | 897 | 666 | 1,563 | 162.8 µs | 19.5 µs | NTRU-SIS |
| HAWK | Lattices | On-ramp | 1024 | 5 | 2,440 | 1,221 | 3,661 | 50.8 µs | 51.4 µs | Lattice Isomorphism |
| HAWK | Lattices | On-ramp | 512 | 1 | 1,024 | 555 | 1,579 | 21.8 µs | 25.0 µs | Lattice Isomorphism |
| MAYO | Multivariate | On-ramp | five | 5 | 5,554 | 964 | 6,518 | 215.4 µs | 91.4 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | three | 3 | 2,986 | 681 | 3,667 | 94.4 µs | 41.3 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | two | 1 | 2,928 | 239 | 3,167 | 26.4 µs | 11.3 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | one | 1 | 1,456 | 464 | 1,920 | 47.2 µs | 20.9 µs | Multivariate Quadratic |
| ML-DSA | Lattices | FIPS | ML-DSA-87 | 5 | 2,592 | 4,627 | 7,219 | 96.7 µs | 54.1 µs | MLWE/MSIS |
| ML-DSA | Lattices | FIPS | ML-DSA-65 | 3 | 1,952 | 3,309 | 5,261 | 76.1 µs | 34.7 µs | MLWE/MSIS |
| ML-DSA | Lattices | FIPS | ML-DSA-44 | 2 | 1,312 | 2,420 | 3,732 | 46.7 µs | 21.6 µs | MLWE/MSIS |
| MQOM | MPCitH | On-ramp | L1-gf2-shorter-ct | 1 | 52 | 2,492 | 2,544 | 2.52 ms | 1.80 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf2-shorter-ot | 1 | 52 | 2,492 | 2,544 | 3.64 ms | 3.51 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-short-ct | 1 | 64 | 2,932 | 2,996 | 807.1 µs | 921.5 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-short-ot | 1 | 64 | 2,932 | 2,996 | 905.9 µs | 899.3 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-fast-ct | 1 | 64 | 3,316 | 3,380 | 272.9 µs | 293.4 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-fast-ot | 1 | 64 | 3,316 | 3,380 | 307.5 µs | 289.9 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf2-shorter-ct | 3 | 78 | 5,932 | 6,010 | 7.27 ms | 6.97 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf2-shorter-ot | 3 | 78 | 5,890 | 5,968 | 9.74 ms | 8.86 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-short-ct | 3 | 96 | 6,556 | 6,652 | 3.75 ms | 4.08 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-short-ot | 3 | 96 | 6,556 | 6,652 | 5.45 ms | 4.92 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-fast-ct | 3 | 96 | 7,564 | 7,660 | 1.13 ms | 1.19 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-fast-ot | 3 | 96 | 7,660 | 7,756 | 1.32 ms | 1.27 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf2-shorter-ct | 5 | 104 | 10,836 | 10,940 | 10.99 ms | 12.28 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf2-shorter-ot | 5 | 104 | 10,804 | 10,908 | 13.71 ms | 13.25 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-short-ct | 5 | 128 | 12,100 | 12,228 | 4.66 ms | 5.57 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-short-ot | 5 | 128 | 11,716 | 11,844 | 6.26 ms | 6.05 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-fast-ct | 5 | 128 | 13,540 | 13,668 | 1.89 ms | 2.00 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-fast-ot | 5 | 128 | 13,380 | 13,508 | 2.38 ms | 2.05 ms | Multivariate Quadratic |
| QR-UOV | Multivariate | On-ramp | I-(127 156 54 3) | 1 | 24,256 | 200 | 24,456 | 142.2 µs | 80.6 µs | UOV |
| QR-UOV | Multivariate | On-ramp | I-(127 540 60 10) | 1 | 11,041 | 541 | 11,582 | 725.7 µs | 230.8 µs | UOV |
| QR-UOV | Multivariate | On-ramp | III-(127 228 78 3) | 3 | 71,884 | 292 | 72,176 | 393.4 µs | 232.5 µs | UOV |
| QR-UOV | Multivariate | On-ramp | III-(127 820 90 10) | 3 | 35,454 | 821 | 36,275 | 2.43 ms | 721.9 µs | UOV |
| QR-UOV | Multivariate | On-ramp | V-(127 306 105 3) | 5 | 173,660 | 392 | 174,052 | 963.9 µs | 540.9 µs | UOV |
| QR-UOV | Multivariate | On-ramp | V-(127 1040 110 10) | 5 | 63,541 | 1,039 | 64,580 | 4.39 ms | 1.42 ms | UOV |
| RSA | Pre-Quantum | Classic | 2048 | N/A | 272 | 256 | 528 | 524.9 µs | 20.2 µs | Factoring |
| RSA | Pre-Quantum | Classic | 3072 | N/A | 422 | 384 | 806 | 1.18 ms | 39.5 µs | Factoring |
| RSA | Pre-Quantum | Classic | 4096 | N/A | 550 | 512 | 1,062 | 2.16 ms | 64.3 µs | Factoring |
| SDitH | MPCitH | On-ramp | SDitH2-L1-gf2-short | 1 | 70 | 3,721 | 3,791 | 2.46 ms | 2.22 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L1-gf2-fast | 1 | 70 | 4,914 | 4,984 | 531.5 µs | 450.2 µs | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L3-gf2-short | 3 | 98 | 8,484 | 8,582 | 11.26 ms | 11.07 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L3-gf2-fast | 3 | 98 | 10,852 | 10,950 | 2.53 ms | 2.38 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L5-gf2-short | 5 | 132 | 15,147 | 15,279 | 17.48 ms | 17.27 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L5-gf2-fast | 5 | 132 | 19,144 | 19,276 | 3.81 ms | 3.58 ms | Synd. Dec. |
| SLH-DSA | Symmetric | FIPS | SHAKE-192s | 3 | 48 | 16,224 | 16,272 | 992.53 ms | 819.9 µs | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-256s | 5 | 64 | 29,792 | 29,856 | 912.60 ms | 1.21 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-128s | 1 | 32 | 7,856 | 7,888 | 556.73 ms | 557.0 µs | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-256f | 5 | 64 | 49,856 | 49,920 | 93.23 ms | 2.43 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-192f | 3 | 48 | 35,664 | 35,712 | 44.85 ms | 2.36 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-128f | 1 | 32 | 17,088 | 17,120 | 27.12 ms | 1.61 ms | Hash-based |
| SNOVA | Multivariate | On-ramp | SNOVA_I_K | 1 | 376 | 528 | 904 | 164.9 µs | 62.3 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_I_B | 1 | 656 | 388 | 1,044 | 176.2 µs | 56.9 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_I_S | 1 | 1,016 | 272 | 1,288 | 130.3 µs | 50.8 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_III_K | 3 | 912 | 688 | 1,600 | 357.7 µs | 128.8 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_III_B | 3 | 1,416 | 532 | 1,948 | 388.3 µs | 129.3 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_III_S | 3 | 2,032 | 456 | 2,488 | 453.6 µs | 133.5 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_V_K | 5 | 1,216 | 896 | 2,112 | 946.2 µs | 276.5 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_V_B | 5 | 1,891 | 691 | 2,582 | 935.5 µs | 211.3 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA_V_S | 5 | 2,716 | 591 | 3,307 | 999.4 µs | 209.3 µs | Non-comm. Ring UOV |
| SQIsign | Isogenies | On-ramp | V | 5 | 169 | 406 | 575 | 209.68 ms | 20.42 ms | Isogenies |
| SQIsign | Isogenies | On-ramp | III | 3 | 129 | 306 | 435 | 99.28 ms | 8.37 ms | Isogenies |
| SQIsign | Isogenies | On-ramp | I | 1 | 83 | 200 | 283 | 25.96 ms | 3.22 ms | Isogenies |
| UOV | Multivariate | On-ramp | V-pkc | 5 | 446,992 | 275 | 447,267 | 120.5 µs | 411.1 µs | UOV |
| UOV | Multivariate | On-ramp | V-classic | 5 | 3,232,320 | 275 | 3,232,595 | 126.8 µs | 115.5 µs | UOV |
| UOV | Multivariate | On-ramp | III-pkc | 3 | 189,232 | 209 | 189,441 | 46.7 µs | 167.4 µs | UOV |
| UOV | Multivariate | On-ramp | III-classic | 3 | 1,347,912 | 209 | 1,348,121 | 44.3 µs | 60.4 µs | UOV |
| UOV | Multivariate | On-ramp | Is-pkc | 1 | 66,576 | 96 | 66,672 | 16.9 µs | 47.6 µs | UOV |
| UOV | Multivariate | On-ramp | Is-classic | 1 | 412,160 | 96 | 412,256 | 17.8 µs | 11.7 µs | UOV |
| UOV | Multivariate | On-ramp | Ip-pkc | 1 | 46,591 | 135 | 46,726 | 15.4 µs | 43.8 µs | UOV |
| UOV | Multivariate | On-ramp | Ip-classic | 1 | 321,300 | 135 | 321,435 | 14.9 µs | 17.6 µs | UOV |
87 parameter sets
Legend: 💣 pre-quantum (classical security only) · 🧨 broken · ⚠️ security warning · ℹ️ note · value estimated from cycle counts · tap icons for details