FAEST

Symmetric · AES · faest.info(opens in a new tab)

Programmes
On-ramp R3
Latest version
v3.0.0 ·
Security flags
None on current sets

Parameter sets

v3.0.0 · 1 Sep 2026

Parameter sets of FAEST
Parameter setLevelpk (B)sig (B)pk+sig (B)SignVerify
128s Recommended 1324,0664,0982.94 ms2.57 ms
128f Recommended 1325,1705,202399.7 µs290.2 µs
EM-128s 1323,4663,4982.11 ms1.83 ms
EM-128f 1324,1704,202335.2 µs222.1 µs
192s Recommended 3489,4109,45811.45 ms9.89 ms
192f Recommended 34811,73811,7861.80 ms1.50 ms
EM-192s 3487,8747,9228.02 ms7.62 ms
EM-192f 3489,8189,8661.14 ms929.9 µs
256s Recommended 54816,62616,67416.04 ms15.69 ms
256f Recommended 54820,85620,9042.57 ms2.13 ms
EM-256s 56414,55414,61812.48 ms12.85 ms
EM-256f 56418,08418,1482.09 ms1.67 ms

Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.

Compare versions

Parameter sets are matched by name.

Change from v2.0 · 7 Feb 2025 to v3.0.0 · 1 Sep 2026
Parameter setLevelPublic key (B) ChangeSignature (B) ChangeSecurity flag (today's assessment)
128s 132 to 32 same4,506 to 4,066 10%smaller—
128f 132 to 32 same5,924 to 5,170 13%smaller—
EM-128s 132 to 32 same3,906 to 3,466 11%smaller—
EM-128f 132 to 32 same5,060 to 4,170 18%smaller—
192s 348 to 48 same11,260 to 9,410 16%smaller—
192f 348 to 48 same14,948 to 11,738 21%smaller—
EM-192s 348 to 48 same9,340 to 7,874 16%smaller—
EM-192f 348 to 48 same12,380 to 9,818 21%smaller—
256s 548 to 48 same20,696 to 16,626 20%smaller—
256f 548 to 48 same26,548 to 20,856 21%smaller—
EM-256s 564 to 64 same17,984 to 14,554 19%smaller—
EM-256f 564 to 64 same23,476 to 18,084 23%smaller—

▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.

History

  1. added to site Update

    Where a specification lists alternative or additional parameter sets next to its main ones, the main sets are now marked, so the Recommended filter hides the alternatives: SNOVA, MAYO, QR-UOV, SQIsign and FAEST (FAEST-EM is the specification's alternative variant), and the NGCC KEMs DTRU (DTRU-Light and DTRU-Prime are the alternatives to the primary tricyclotomic sets) and MAMBA-Frost (the compact-ciphertext CC variants are additional to the default sets). The round-3 specifications of SNOVA (Table 6), MAYO (Table 2.2), QR-UOV (Appendix B) and SQIsign (Appendix P) also list alternative or additional parameter sets; these are now shown under All parameter sets, with sizes from the specifications. The six odd-characteristic SNOVA alternatives are marked broken by Beullens & Hess's vinegar-bias attack.

  2. added to site New version

    v3.0.0

    FAEST v3.0.0 released (release notes), the round-3 spec update. It restructures the VOLE-commitment construction around a new CRT-based scheme and, per issue #18, aligns the spec text for the first Fiat-Shamir challenge (chall_1) with what the implementation already computed (no forgery or key-recovery — a transcript-binding clarification). Signature sizes shrink by roughly 10–15% across all parameter sets (e.g. 128s: 4506→4066 bytes, 256f: 26548→20856 bytes); public-key sizes are unchanged. v2.0 is not broken, just superseded as the pinned round-3 submission.

  3. Update

    Updated FAEST performance data to use the AVX2+AES-NI optimized implementation (faest-arch-opt) instead of the reference implementation. Signing is 10–100× faster depending on the parameter set.

  4. Milestone

    NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.

  5. New version

    v2.0

  6. New version

    v1.0

Full timeline →