Post-Quantum Signature Schemes
Comparing NIST on-ramp candidates and standardized schemes. Click column headers to sort. Use the filters to narrow down by category, security level, or size constraints.
Data reflects the latest known specifications for each scheme, last updated 2026-04-03. Consult the individual scheme websites for the most current information.
Filters ▼
pk size vs. sig size (log–log scale)
Shape = family · tap point for details
Scroll to zoom · drag to pan
Performance note: Cycle counts are from our own benchmarks on a 12th Gen Intel(R) Core(TM) i7-12650H —
see the environment details below.
| Scheme ▲ | Category | Status | Parameter Set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify | Assumption |
|---|---|---|---|---|---|---|---|---|---|---|
| ECDSA | Pre-Quantum | Classic | P-256 | N/A | 65 | 72 | 137 | 23.7 µs | 71.0 µs | Elliptic Curves |
| ECDSA | Pre-Quantum | Classic | P-384 | N/A | 97 | 104 | 201 | 653.8 µs | 554.7 µs | Elliptic Curves |
| ECDSA | Pre-Quantum | Classic | P-521 | N/A | 133 | 139 | 272 | 1.66 ms | 1.33 ms | Elliptic Curves |
| EdDSA | Pre-Quantum | Classic | Ed25519 | N/A | 32 | 64 | 96 | 36.1 µs | 96.0 µs | Elliptic Curves |
| EdDSA | Pre-Quantum | Classic | Ed448 | N/A | 57 | 114 | 171 | 220.0 µs | 181.1 µs | Elliptic Curves |
| FAEST | Symmetric | On-ramp | 128s | 1 | 32 | 4,506 | 4,538 | 4.47 ms | 3.63 ms | AES |
| FAEST | Symmetric | On-ramp | 128f | 1 | 32 | 5,924 | 5,956 | 590.2 µs | 478.2 µs | AES |
| FAEST | Symmetric | On-ramp | EM-128s | 1 | 32 | 3,906 | 3,938 | 2.74 ms | 2.34 ms | AES |
| FAEST | Symmetric | On-ramp | EM-128f | 1 | 32 | 5,060 | 5,092 | 411.9 µs | 339.4 µs | AES |
| FAEST | Symmetric | On-ramp | 192s | 3 | 48 | 11,260 | 11,308 | 19.31 ms | 16.12 ms | AES |
| FAEST | Symmetric | On-ramp | 192f | 3 | 48 | 14,948 | 14,996 | 2.35 ms | 2.15 ms | AES |
| FAEST | Symmetric | On-ramp | EM-192s | 3 | 48 | 9,340 | 9,388 | 13.75 ms | 13.17 ms | AES |
| FAEST | Symmetric | On-ramp | EM-192f | 3 | 48 | 12,380 | 12,428 | 1.60 ms | 1.51 ms | AES |
| FAEST | Symmetric | On-ramp | 256s | 5 | 48 | 20,696 | 20,744 | 23.94 ms | 24.18 ms | AES |
| FAEST | Symmetric | On-ramp | 256f | 5 | 48 | 26,548 | 26,596 | 3.37 ms | 3.33 ms | AES |
| FAEST | Symmetric | On-ramp | EM-256s | 5 | 64 | 17,984 | 18,048 | 19.93 ms | 19.20 ms | AES |
| FAEST | Symmetric | On-ramp | EM-256f | 5 | 64 | 23,476 | 23,540 | 2.78 ms | 2.84 ms | AES |
| Falcon | Lattices | Std pending | 1024 | 5 | 1,793 | 1,280 | 3,073 | 433.4 µs | 41.5 µs | NTRU-SIS |
| Falcon | Lattices | Std pending | 512 | 1 | 897 | 666 | 1,563 | 211.6 µs | 22.2 µs | NTRU-SIS |
| HAWK | Lattices | On-ramp | 1024 | 5 | 2,440 | 1,221 | 3,661 | 59.4 µs | 67.8 µs | Lattice Isomorphism |
| HAWK | Lattices | On-ramp | 512 | 1 | 1,024 | 555 | 1,579 | 24.4 µs | 28.4 µs | Lattice Isomorphism |
| MAYO | Multivariate | On-ramp | five | 5 | 5,554 | 964 | 6,518 | 871.4 µs | 372.8 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | three | 3 | 2,986 | 681 | 3,667 | 496.3 µs | 216.9 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | two | 1 | 4,912 | 186 | 5,098 | 107.0 µs | 19.3 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp | one | 1 | 1,420 | 454 | 1,874 | 233.1 µs | 104.8 µs | Multivariate Quadratic |
| ML-DSA | Lattices | FIPS | ML-DSA-87 | 5 | 2,592 | 4,627 | 7,219 | 118.2 µs | 64.0 µs | MLWE/MSIS |
| ML-DSA | Lattices | FIPS | ML-DSA-65 | 3 | 1,952 | 3,309 | 5,261 | 84.3 µs | 37.8 µs | MLWE/MSIS |
| ML-DSA | Lattices | FIPS | ML-DSA-44 | 2 | 1,312 | 2,420 | 3,732 | 53.0 µs | 24.6 µs | MLWE/MSIS |
| MQOM | MPCitH | On-ramp | L1-gf2-short-3r | 1 | 52 | 2,868 | 2,920 | 2.74 ms | 2.27 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf2-short-5r | 1 | 52 | 2,820 | 2,872 | 2.68 ms | 2.29 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-short-3r | 1 | 60 | 3,060 | 3,120 | 2.75 ms | 1.98 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-short-5r | 1 | 60 | 2,916 | 2,976 | 2.33 ms | 1.86 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf256-short-3r | 1 | 80 | 3,540 | 3,620 | 2.88 ms | 1.94 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf256-short-5r | 1 | 80 | 3,156 | 3,236 | 2.76 ms | 1.80 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf2-fast-3r | 1 | 52 | 3,212 | 3,264 | 1.34 ms | 1.10 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf2-fast-5r | 1 | 52 | 3,144 | 3,196 | 1.46 ms | 1.23 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-fast-3r | 1 | 60 | 3,484 | 3,544 | 982.3 µs | 744.6 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf16-fast-5r | 1 | 60 | 3,280 | 3,340 | 742.1 µs | 605.5 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf256-fast-3r | 1 | 80 | 4,164 | 4,244 | 992.2 µs | 748.9 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L1-gf256-fast-5r | 1 | 80 | 3,620 | 3,700 | 1.11 ms | 839.7 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf2-short-3r | 3 | 78 | 6,388 | 6,466 | 11.62 ms | 10.09 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf2-short-5r | 3 | 78 | 6,280 | 6,358 | 12.36 ms | 11.47 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-short-3r | 3 | 90 | 6,820 | 6,910 | 12.18 ms | 10.18 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-short-5r | 3 | 90 | 6,496 | 6,586 | 11.25 ms | 10.51 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf256-short-3r | 3 | 120 | 7,900 | 8,020 | 15.49 ms | 12.66 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf256-short-5r | 3 | 120 | 7,036 | 7,156 | 11.21 ms | 8.65 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf2-fast-3r | 3 | 78 | 7,576 | 7,654 | 6.54 ms | 6.05 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf2-fast-5r | 3 | 78 | 7,414 | 7,492 | 6.33 ms | 6.17 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-fast-3r | 3 | 90 | 8,224 | 8,314 | 3.06 ms | 2.75 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf16-fast-5r | 3 | 90 | 7,738 | 7,828 | 3.48 ms | 3.30 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf256-fast-3r | 3 | 120 | 9,844 | 9,964 | 4.21 ms | 3.86 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L3-gf256-fast-5r | 3 | 120 | 8,548 | 8,668 | 3.83 ms | 3.52 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf2-short-3r | 5 | 104 | 11,764 | 11,868 | 21.17 ms | 18.66 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf2-short-5r | 5 | 104 | 11,564 | 11,668 | 20.00 ms | 17.99 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-short-3r | 5 | 122 | 12,664 | 12,786 | 16.98 ms | 15.15 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-short-5r | 5 | 122 | 12,014 | 12,136 | 14.62 ms | 14.86 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf256-short-3r | 5 | 160 | 14,564 | 14,724 | 22.34 ms | 18.22 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf256-short-5r | 5 | 160 | 12,964 | 13,124 | 16.22 ms | 14.17 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf2-fast-3r | 5 | 104 | 13,412 | 13,516 | 13.60 ms | 13.38 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf2-fast-5r | 5 | 104 | 13,124 | 13,228 | 10.13 ms | 9.59 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-fast-3r | 5 | 122 | 14,708 | 14,830 | 6.73 ms | 6.14 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf16-fast-5r | 5 | 122 | 13,772 | 13,894 | 5.50 ms | 5.37 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf256-fast-3r | 5 | 160 | 17,444 | 17,604 | 7.49 ms | 6.40 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp | L5-gf256-fast-5r | 5 | 160 | 15,140 | 15,300 | 6.75 ms | 6.00 ms | Multivariate Quadratic |
| QR-UOV | Multivariate | On-ramp | I-(127 156 54 3) | 1 | 24,255 | 200 | 24,455 | 1.88 ms | 1.59 ms | UOV |
| QR-UOV | Multivariate | On-ramp | I-(31 165 60 3) | 1 | 23,641 | 157 | 23,798 | 2.54 ms | 2.17 ms | UOV |
| QR-UOV | Multivariate | On-ramp | I-(31 600 70 10) | 1 | 12,266 | 435 | 12,701 | 11.87 ms | 11.61 ms | UOV |
| QR-UOV | Multivariate | On-ramp | I-(7 740 100 10) | 1 | 20,641 | 331 | 20,972 | 30.99 ms | 30.05 ms | UOV |
| QR-UOV | Multivariate | On-ramp | III-(127 228 78 3) | 3 | 71,891 | 292 | 72,183 | 5.92 ms | 5.20 ms | UOV |
| QR-UOV | Multivariate | On-ramp | III-(31 246 87 3) | 3 | 70,983 | 232 | 71,215 | 7.83 ms | 6.83 ms | UOV |
| QR-UOV | Multivariate | On-ramp | III-(31 890 100 10) | 3 | 34,399 | 643 | 35,042 | 38.74 ms | 38.24 ms | UOV |
| QR-UOV | Multivariate | On-ramp | III-(7 1100 140 10) | 3 | 55,149 | 489 | 55,638 | 103.76 ms | 100.68 ms | UOV |
| QR-UOV | Multivariate | On-ramp | V-(127 306 105 3) | 5 | 173,676 | 392 | 174,068 | 14.68 ms | 12.78 ms | UOV |
| QR-UOV | Multivariate | On-ramp | V-(31 1120 120 10) | 5 | 58,532 | 807 | 59,339 | 75.17 ms | 71.17 ms | UOV |
| QR-UOV | Multivariate | On-ramp | V-(31 324 114 3) | 5 | 158,421 | 306 | 158,727 | 18.32 ms | 15.96 ms | UOV |
| QR-UOV | Multivariate | On-ramp | V-(7 1490 190 10) | 5 | 135,407 | 662 | 136,069 | 263.65 ms | 247.58 ms | UOV |
| RSA | Pre-Quantum | Classic | 2048 | N/A | 272 | 256 | 528 | 912.8 µs | 23.4 µs | Factoring |
| RSA | Pre-Quantum | Classic | 3072 | N/A | 422 | 384 | 806 | 2.25 ms | 42.4 µs | Factoring |
| RSA | Pre-Quantum | Classic | 4096 | N/A | 550 | 512 | 1,062 | 5.26 ms | 78.8 µs | Factoring |
| SDitH | MPCitH | On-ramp | SDitH2-L1-gf2-short | 1 | 70 | 3,705 | 3,775 | 11.55 ms | 9.94 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L1-gf2-fast | 1 | 70 | 4,484 | 4,554 | 3.37 ms | 2.96 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L3-gf2-short | 3 | 98 | 7,964 | 8,062 | 61.01 ms | 58.47 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L3-gf2-fast | 3 | 98 | 9,916 | 10,014 | 9.90 ms | 8.81 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L5-gf2-short | 5 | 132 | 14,121 | 14,253 | 82.53 ms | 79.56 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp | SDitH2-L5-gf2-fast | 5 | 132 | 17,540 | 17,672 | 14.07 ms | 13.15 ms | Synd. Dec. |
| SLH-DSA | Symmetric | FIPS | SHAKE-192s | 3 | 48 | 16,224 | 16,272 | 1.53 s | 1.25 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-256s | 5 | 64 | 29,792 | 29,856 | 1.36 s | 1.84 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-128s | 1 | 32 | 7,856 | 7,888 | 875.90 ms | 867.1 µs | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-256f | 5 | 64 | 49,856 | 49,920 | 146.28 ms | 3.86 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-192f | 3 | 48 | 35,664 | 35,712 | 62.75 ms | 3.55 ms | Hash-based |
| SLH-DSA | Symmetric | FIPS | SHAKE-128f | 1 | 32 | 17,088 | 17,120 | 42.84 ms | 2.60 ms | Hash-based |
| SNOVA | Multivariate | On-ramp | SNOVA-60-10-16-4 | 5 | 8,016 | 576 | 8,592 | 3.03 ms | 859.9 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-50-9-19-4 | 5 | 3,213 | 520 | 3,733 | 1.17 ms | 536.0 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-97-33-16-2 | 5 | 71,890 | 276 | 72,166 | 8.29 ms | 1.67 ms | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-37-8-16-4 | 3 | 4,112 | 376 | 4,488 | 1.08 ms | 304.7 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-40-7-19-4 | 3 | 1,532 | 418 | 1,950 | 555.5 µs | 267.3 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-72-25-16-2 | 3 | 31,266 | 210 | 31,476 | 2.87 ms | 651.6 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-38-5-16-4x5 | 3 | 1,416 | 446 | 1,862 | 811.3 µs | 434.6 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-38-5-19-4x5 | 3 | 800 | 475 | 1,275 | 705.4 µs | 276.2 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-24-5-16-4 | 1 | 1,016 | 248 | 1,264 | 348.6 µs | 92.2 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-28-5-19-4 | 1 | 576 | 298 | 874 | 214.0 µs | 99.5 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-48-17-16-2 | 1 | 9,842 | 146 | 9,988 | 805.3 µs | 190.1 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-48-16-19-2 | 1 | 4,522 | 153 | 4,675 | 391.7 µs | 204.2 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-28-4-16-4x5 | 1 | 656 | 336 | 992 | 370.4 µs | 181.2 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp | SNOVA-28-4-19-4x5 | 1 | 379 | 358 | 737 | 348.6 µs | 131.6 µs | Non-comm. Ring UOV |
| SQIsign | Isogenies | On-ramp | V | 5 | 129 | 292 | 421 | 215.70 ms | 17.82 ms | Isogenies |
| SQIsign | Isogenies | On-ramp | III | 3 | 97 | 224 | 321 | 130.16 ms | 9.16 ms | Isogenies |
| SQIsign | Isogenies | On-ramp | I | 1 | 65 | 148 | 213 | 49.39 ms | 3.44 ms | Isogenies |
| UOV | Multivariate | On-ramp | V-pkc | 5 | 446,992 | 260 | 447,252 | 140.6 µs | 402.3 µs | UOV |
| UOV | Multivariate | On-ramp | V-classic | 5 | 2,869,440 | 260 | 2,869,700 | 150.6 µs | 134.3 µs | UOV |
| UOV | Multivariate | On-ramp | III-pkc | 3 | 189,232 | 200 | 189,432 | 80.0 µs | 201.5 µs | UOV |
| UOV | Multivariate | On-ramp | III-classic | 3 | 1,225,440 | 200 | 1,225,640 | 68.7 µs | 61.5 µs | UOV |
| UOV | Multivariate | On-ramp | Is-pkc | 1 | 66,576 | 96 | 66,672 | 27.5 µs | 58.1 µs | UOV |
| UOV | Multivariate | On-ramp | Is-classic | 1 | 412,160 | 96 | 412,256 | 26.6 µs | 16.1 µs | UOV |
| UOV | Multivariate | On-ramp | Ip-pkc | 1 | 43,576 | 128 | 43,704 | 25.0 µs | 47.2 µs | UOV |
| UOV | Multivariate | On-ramp | Ip-classic | 1 | 278,432 | 128 | 278,560 | 17.9 µs | 14.4 µs | UOV |
116 parameter sets
Legend: 💣 pre-quantum (classical security only) · 🧨 broken · ⚠️ security warning · ℹ️ note · value estimated from cycle counts · tap icons for details
Benchmark environment
Date 26 May 2026
CPU 12th Gen Intel(R) Core(TM) i7-12650H — 8 cores,
2 threads/core,
4600 MHz max, governor: powersave, turbo: enabled
OS Debian GNU/Linux 13 (trixie) (kernel 6.19.11-zabbly+)
Compiler cc (Debian 14.2.0-19) 14.2.0
OpenSSL OpenSSL 3.6.2 7 Apr 2026 (Library: OpenSSL 3.6.2 7 Apr 2026)
Method Median over 1000 iterations (fewer for slow schemes). Cycle counter: rdtsc + lfence (constant TSC rate, not execution cycles). Wall clock: clock_gettime(CLOCK_MONOTONIC).
Implementation sources ▸
- faest faest-sign/faest-arch-opt@09b2ffbc
- fndsa pornin/c-fn-dsa@33026d4d
- hawk hawk-sign/dev@1b9fef52
- mayo PQCMayo/MAYO-C@4108b71d
- mldsa pq-crystals/dilithium.git@6e00625c
- mqom mqom/mqom-v2@9a5a4d51
- qruov qruov/round2.git@787f8dba
- sdith sdith/sdith@fff41ae5
- sdith2 sdith.org/docs/sdith-package-v2.zip
- slhdsa pq-code-package/slhdsa-c@fac08b7d
- snova PQCLAB-SNOVA/SNOVA.git@9da14981
- sqisign SQISign/the-sqisign@91e9e464
- uov pqov/pqov.git@49dc53c0
Benchmark data licensed under CC-BY-4.0 — Thom Wiggers / PQShield